Oracle disclosed a critical, easily exploitable vulnerability in JD Edwards EnterpriseOne Tools that lets an unauthenticated attacker take over the product over HTTP, rated CVSS 9.8.
What Is It
CVE-2026-61272 is a vulnerability in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools. Per the vendor-supplied CVE description, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful attacks result in full takeover of JD Edwards EnterpriseOne Tools.
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. The exploitability subscore is 3.9, the maximum for that metric.
Why It Matters
Every barrier that normally slows an attacker down is absent here. There is no authentication requirement, no user to phish, and no complex preconditions; just HTTP reachability to the affected service. The outcome is not partial data disclosure but takeover of the ERP tooling layer, meaning an attacker who reaches the Web Runtime SEC component gains full read, write, and disruption capability.
JD Edwards EnterpriseOne is enterprise resource planning software, so any instance exposed to untrusted networks should be treated as a priority. Note that this record was published 2026-08-18 with a status of "Received," and no CISA KEV entry was supplied; there is no confirmation of active exploitation in the source material.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: JD Edwards EnterpriseOne Tools
- Component: Web Runtime SEC
- Affected versions: 9.2.0.0 through 9.2.26.4 (inclusive)
No affected CPE entries were listed in the NVD record beyond the vendor-supplied version range.
Patch Status
The supplied data does not identify a specific fixed release, and the record is still in "Received" status, it has not yet been analyzed and enriched by NVD, so patch details should be treated as provisional until that analysis completes. Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October. This record was published on 2026-08-18, after the July 2026 Critical Patch Update had already shipped, so the next scheduled vehicle for a fix is the October 2026 Critical Patch Update; there is no August cycle, and anything sooner would have to arrive as an out-of-cycle Oracle Security Alert.
Administrators running any version in the 9.2.0.0–9.2.26.4 range should check the current Oracle Critical Patch Update advisories directly for JD Edwards EnterpriseOne Tools entries covering CVE-2026-61272, and in the meantime restrict HTTP reachability to the Web Runtime SEC component from untrusted networks. No required-action deadline was specified in the supplied data, as no KEV entry accompanied this CVE.