# Oracle patches 24 JD Edwards EnterpriseOne flaws

Published: 2026-10-22 · Severity: elevated
Canonical: https://vorant.io/reports/dd105df3-a99c-56c5-a181-4def318c4754/oracle-patches-24-jd-edwards-enterpriseone-flaws

> NCSC-NL advisory covers 24 vulnerabilities in Oracle JD Edwards EnterpriseOne Tools, several unauthenticated and rated up to CVSS 9.8.

NCSC-NL has published an advisory summarizing Oracle's patches for 24 vulnerabilities affecting JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. The flaws span multiple weakness classes including classic buffer overflows, missing authentication for critical functions, deserialization of untrusted data, and out-of-bounds writes. Several of the vulnerabilities can be exploited over common network protocols (HTTP, HTTPS, SMTP) without authentication or with only low privileges, and some require no user interaction while others do.

Successful exploitation can allow an attacker to create, modify, or delete data, and in some cases achieve full system compromise, affecting confidentiality, integrity, and availability. Two of the listed CVEs (CVE-2022-45378 and CVE-2025-15467) carry the maximum CVSS score of 9.8, while the remainder range from 8.1 to 9.1, indicating a broad set of high-impact issues bundled in this release rather than a single critical zero-day.

No evidence of active exploitation is cited in this advisory. Defenders running Oracle JD Edwards EnterpriseOne Tools in the affected version range should apply Oracle's released updates promptly, prioritizing internet- or intranet-exposed instances reachable via HTTP/HTTPS/SMTP, and review authentication and input-validation configurations as an interim mitigation where patching is delayed.

## Mentioned in this report

- Vulnerabilities: CVE-2022-45378, CVE-2025-15467, CVE-2026-87305, CVE-2026-87306, CVE-2026-87309, CVE-2026-87310, CVE-2026-87313, CVE-2026-91265, CVE-2026-91266, CVE-2026-91267, CVE-2026-91268, CVE-2026-91269, CVE-2026-91270, CVE-2026-91271, CVE-2026-91273, CVE-2026-91286, CVE-2026-91287, CVE-2026-91295, CVE-2026-91296, CVE-2026-91303, CVE-2026-91305, CVE-2026-91310, CVE-2026-91313, CVE-2026-91326

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0446.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dd105df3-a99c-56c5-a181-4def318c4754/oracle-patches-24-jd-edwards-enterpriseone-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup