SB20261110161 - Multiple vulnerabilities in JD Edwards EnterpriseOne Tools

Description

This security bulletin contains information about 87 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-91325)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

2) Improper input validation (CVE-ID: CVE-2026-87306)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

3) Improper input validation (CVE-ID: CVE-2026-87305)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

4) Improper input validation (CVE-ID: CVE-2026-91328)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Deployment SEC component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

5) Improper input validation (CVE-ID: CVE-2026-87316)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to execute arbitrary code.

6) Improper input validation (CVE-ID: CVE-2026-91304)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

7) Improper input validation (CVE-ID: CVE-2026-91306)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to execute arbitrary code.

8) Improper input validation (CVE-ID: CVE-2026-91311)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to execute arbitrary code.

9) Improper input validation (CVE-ID: CVE-2026-91314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

10) Improper input validation (CVE-ID: CVE-2026-91315)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

11) Improper input validation (CVE-ID: CVE-2026-87315)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

12) Improper input validation (CVE-ID: CVE-2026-91287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

13) Improper input validation (CVE-ID: CVE-2026-87312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

14) Improper input validation (CVE-ID: CVE-2026-91307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

15) Improper input validation (CVE-ID: CVE-2026-91308)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

16) Improper input validation (CVE-ID: CVE-2026-91327)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

17) Improper input validation (CVE-ID: CVE-2026-91272)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

18) Improper input validation (CVE-ID: CVE-2026-91288)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

19) Improper input validation (CVE-ID: CVE-2026-87314)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

20) Improper input validation (CVE-ID: CVE-2026-87307)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

21) Improper input validation (CVE-ID: CVE-2026-87308)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

22) Improper input validation (CVE-ID: CVE-2026-87320)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - UNIX component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to execute arbitrary code.

23) Improper input validation (CVE-ID: CVE-2026-87310)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Database and Comm SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

24) Stack-based buffer overflow (CVE-ID: CVE-2025-15467)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters. A remote attacker can supply a specially crafted CMS message with an oversized IV, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

25) Exposed dangerous method or function (CVE-ID: CVE-2022-45378)

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication when accessing the RPCRouterServlet servlet. A remote attacker can invoke certain methods on the classpath and execute arbitrary code on the system.

26) Improper input validation (CVE-ID: CVE-2026-91265)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

27) Improper input validation (CVE-ID: CVE-2026-91305)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

28) Improper input validation (CVE-ID: CVE-2026-91295)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

29) Improper input validation (CVE-ID: CVE-2026-91296)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

30) Improper input validation (CVE-ID: CVE-2026-91303)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

31) Improper input validation (CVE-ID: CVE-2026-91270)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

32) Improper input validation (CVE-ID: CVE-2026-91268)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

33) Improper input validation (CVE-ID: CVE-2026-91326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

34) Improper input validation (CVE-ID: CVE-2026-87383)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Package Build SEC component in JD Edwards EnterpriseOne Tools. A local privileged user can exploit this vulnerability to execute arbitrary code.

35) Improper input validation (CVE-ID: CVE-2026-91310)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

36) Improper input validation (CVE-ID: CVE-2026-87313)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to execute arbitrary code.

37) Improper input validation (CVE-ID: CVE-2026-91273)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Object and Env Tech SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

38) Improper input validation (CVE-ID: CVE-2026-91267)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

39) Improper input validation (CVE-ID: CVE-2026-91266)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

40) Improper input validation (CVE-ID: CVE-2026-91286)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

41) Improper input validation (CVE-ID: CVE-2026-91269)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

42) Improper input validation (CVE-ID: CVE-2026-91313)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

43) Improper input validation (CVE-ID: CVE-2026-91271)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

44) Improper input validation (CVE-ID: CVE-2026-87309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to damange or delete data.

The vulnerability exists due to improper input validation within the Package Build SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to damange or delete data.

45) Improper input validation (CVE-ID: CVE-2026-87317)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to manipulate or delete data.

46) Improper input validation (CVE-ID: CVE-2026-87327)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

47) Improper input validation (CVE-ID: CVE-2026-87323)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

48) Improper input validation (CVE-ID: CVE-2026-91278)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

49) Improper input validation (CVE-ID: CVE-2026-91290)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

50) Improper input validation (CVE-ID: CVE-2026-91455)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - UNIX component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

51) Improper input validation (CVE-ID: CVE-2026-91298)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

52) Improper input validation (CVE-ID: CVE-2026-87381)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Business Logic Infra SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

53) Improper input validation (CVE-ID: CVE-2026-91293)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read memory contents or crash the application.

The vulnerability exists due to improper input validation within the Business Logic Infra SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read memory contents or crash the application.

54) Improper input validation (CVE-ID: CVE-2026-91289)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

55) Improper validation of certificate with host mismatch (CVE-ID: CVE-2025-68161)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N]

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the "verifyHostName" configuration attribute or the "log4j2.sslVerifyHostName"  system property is set to true. A remote attacker can perform MitM attack and intercept or redirect the log traffic. 

56) Improper input validation (CVE-ID: CVE-2026-87328)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

57) Improper input validation (CVE-ID: CVE-2026-91283)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

58) Improper input validation (CVE-ID: CVE-2026-91294)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform service disruption.

The vulnerability exists due to improper input validation within the Business Logic Infra SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to perform service disruption.

59) Improper input validation (CVE-ID: CVE-2026-87330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - UNIX component in JD Edwards EnterpriseOne Tools. A local privileged user can exploit this vulnerability to read and manipulate data.

60) Improper input validation (CVE-ID: CVE-2026-91291)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Business Logic Infra SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

61) Improper input validation (CVE-ID: CVE-2026-87333)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

62) Improper input validation (CVE-ID: CVE-2026-91301)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to manipulate or delete data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to manipulate or delete data.

63) Improper input validation (CVE-ID: CVE-2026-87331)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - UNIX component in JD Edwards EnterpriseOne Tools. A local privileged user can exploit this vulnerability to manipulate or delete data.

64) Improper input validation (CVE-ID: CVE-2026-91302)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to perform service disruption.

65) Improper input validation (CVE-ID: CVE-2026-91330)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to perform service disruption.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to perform service disruption.

66) Improper input validation (CVE-ID: CVE-2026-91300)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

67) Improper input validation (CVE-ID: CVE-2026-87321)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Package Build SEC component in JD Edwards EnterpriseOne Tools. A local privileged user can exploit this vulnerability to execute arbitrary code.

68) Improper input validation (CVE-ID: CVE-2026-91383)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote privileged user can exploit this vulnerability to read and manipulate data.

69) Improper input validation (CVE-ID: CVE-2026-91275)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote privileged user can exploit this vulnerability to read and manipulate data.

70) Improper input validation (CVE-ID: CVE-2026-91274)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

71) Improper input validation (CVE-ID: CVE-2026-91284)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - UNIX component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

72) Improper input validation (CVE-ID: CVE-2026-91384)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to gain access to sensitive information.

73) Improper input validation (CVE-ID: CVE-2026-87329)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to execute arbitrary code.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to execute arbitrary code.

74) Improper input validation (CVE-ID: CVE-2026-91312)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to gain access to sensitive information.

75) Improper input validation (CVE-ID: CVE-2026-91329)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Installation Security component in JD Edwards EnterpriseOne Tools. A local non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

76) Improper input validation (CVE-ID: CVE-2026-87324)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

77) Improper input validation (CVE-ID: CVE-2026-87325)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote authenticated user can exploit this vulnerability to read and manipulate data.

78) Improper input validation (CVE-ID: CVE-2026-87332)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to manipulate or delete data.

The vulnerability exists due to improper input validation within the E1 Dev Platform Tech - Cloud component in JD Edwards EnterpriseOne Tools. A local privileged user can exploit this vulnerability to manipulate or delete data.

79) Improper input validation (CVE-ID: CVE-2026-87318)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

80) Improper input validation (CVE-ID: CVE-2026-87319)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A local authenticated user can exploit this vulnerability to read and manipulate data.

81) Improper input validation (CVE-ID: CVE-2026-91281)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

82) Improper input validation (CVE-ID: CVE-2026-91297)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Monitoring and Diagnostics SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

83) Improper input validation (CVE-ID: CVE-2026-91279)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

84) Improper input validation (CVE-ID: CVE-2026-91280)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Web Runtime SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

85) Improper input validation (CVE-ID: CVE-2026-87326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Enterprise Infrastructure SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

86) Improper input validation (CVE-ID: CVE-2026-91282)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Portal SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

87) Improper input validation (CVE-ID: CVE-2026-91309)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Interoperability SEC component in JD Edwards EnterpriseOne Tools. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpuoct2026.html