CVE-2026-46882: Critical severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If JDENET is not required for normal operation, disable the JDENET listener or otherwise disable JDENET network access on JD Edwards EnterpriseOne Tools instances to remove the network attack surface.
JD Edwards EnterpriseOne Tools (Enterprise Infrastructure Security) JDENET network access/listener = disabled if not required - Compensating control
Restrict access to JDENET at the network perimeter and internal firewalls/ACLs: block JDENET protocol/ports from untrusted networks and allow connections only from trusted management networks or specific trusted IP addresses.
- Compensating control
Isolate JD Edwards EnterpriseOne Tools hosts on a protected network segment (VLAN) with strict access controls and network segmentation to prevent direct JDENET access from untrusted networks.
- Operational
Monitor JDENET-related logs and indicators of compromise for suspicious activity, and apply vendor-supplied patches or updates for JD Edwards EnterpriseOne Tools as soon as Oracle releases fixes for this vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46882?
CVE-2026-46882 has a critical severity rating of 9.8.
How do I fix CVE-2026-46882?
To fix CVE-2026-46882, upgrade to the latest supported version of Oracle JD Edwards EnterpriseOne Tools.
What impact does CVE-2026-46882 have on affected systems?
CVE-2026-46882 allows an unauthenticated attacker to compromise confidentiality, integrity, and availability.
Which versions of Oracle JD Edwards are affected by CVE-2026-46882?
The affected versions of Oracle JD Edwards EnterpriseOne Tools are from 9.2.0.0 to 9.2.26.2.
Is CVE-2026-46882 easily exploitable?
Yes, CVE-2026-46882 is considered easily exploitable by attackers with network access.