Oracle patches 24 JD Edwards EnterpriseOne flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
NCSC-NL advisory covers 24 vulnerabilities in Oracle JD Edwards EnterpriseOne Tools, several unauthenticated and rated up to CVSS 9.8.
NCSC-NL has published an advisory summarizing Oracle's patches for 24 vulnerabilities affecting JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. The flaws span multiple weakness classes including classic buffer overflows, missing authentication for critical functions, deserialization of untrusted data, and out-of-bounds writes. Several of the vulnerabilities can be exploited over common network protocols (HTTP, HTTPS, SMTP) without authentication or with only low privileges, and some require no user interaction while others do.
Successful exploitation can allow an attacker to create, modify, or delete data, and in some cases achieve full system compromise, affecting confidentiality, integrity, and availability. Two of the listed CVEs (CVE-2022-45378 and CVE-2025-15467) carry the maximum CVSS score of 9.8, while the remainder range from 8.1 to 9.1, indicating a broad set of high-impact issues bundled in this release rather than a single critical zero-day.
No evidence of active exploitation is cited in this advisory. Defenders running Oracle JD Edwards EnterpriseOne Tools in the affected version range should apply Oracle's released updates promptly, prioritizing internet- or intranet-exposed instances reachable via HTTP/HTTPS/SMTP, and review authentication and input-validation configurations as an interim mitigation where patching is delayed.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0446.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,894 reports from 143 sources, 513 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs