CVE-2026-46881: Critical severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If JDENET is not required, disable the JDENET service. Otherwise restrict JDENET network access to only necessary/trusted hosts and network segments (remove public/internet access).
JD Edwards EnterpriseOne Tools (JDENET) network_access = restricted to trusted hosts / disabled if not required - Compensating control
Block or filter JDENET traffic at the network perimeter and intermediate firewalls (deny JDENET protocol/ports from untrusted networks). Allow access only from specific trusted IP addresses or VPNs.
- Compensating control
Place JD Edwards EnterpriseOne Infrastructure servers in a network zone with strict segmentation and access controls (isolated management network) to limit lateral movement.
- Operational
Assume compromise is possible given the vulnerability’s impact. Immediately isolate suspected systems, perform incident investigation and forensic review of logs, and rebuild affected systems if compromise is confirmed.
- Operational
Rotate credentials and secrets used by JD Edwards EnterpriseOne components and any integrated systems if there is any indication of compromise or as a precautionary measure after remediation.
- Operational
Monitor vendor advisories and apply any Oracle-issued patches or updates for JD Edwards EnterpriseOne Tools as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46881?
CVE-2026-46881 has a critical severity rating of 9.8.
How do I fix CVE-2026-46881?
To fix CVE-2026-46881, update your version of Oracle JD Edwards EnterpriseOne Tools to a secure version beyond 9.2.26.2.
What products are affected by CVE-2026-46881?
CVE-2026-46881 affects the JD Edwards EnterpriseOne Tools product, specifically versions 9.2.0.0 to 9.2.26.2.
Can an attacker exploit CVE-2026-46881 remotely?
Yes, CVE-2026-46881 can be exploited remotely by an unauthenticated attacker with network access via JDENET.
What types of impacts can result from CVE-2026-46881?
CVE-2026-46881 can lead to high levels of confidentiality, integrity, and availability impact.