CVE-2026-46904: Critical severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If JDENET is not required for normal operation, disable JDENET on JD Edwards EnterpriseOne Tools to remove the network access vector used by this vulnerability. If JDENET is required, restrict its exposure as described in compensating controls.
JDENET (JD Edwards EnterpriseOne Tools) network_access/enable = false (if not required) - Compensating control
Restrict JDENET network access at network boundaries: block or filter JDENET traffic at perimeter firewalls and internal segmentation points, and allow access only from trusted IPs/management networks. Isolate JD Edwards EnterpriseOne Tools from untrusted networks until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46904?
CVE-2026-46904 has a critical severity rating of 9.8.
Who is affected by CVE-2026-46904?
CVE-2026-46904 affects supported versions of Oracle JD Edwards EnterpriseOne Tools from 9.2.0.0 to 9.2.26.2.
What are the potential impacts of CVE-2026-46904?
CVE-2026-46904 allows an unauthenticated attacker with network access to compromise the system.
How do I fix CVE-2026-46904?
To mitigate CVE-2026-46904, upgrade to a non-vulnerable version of Oracle JD Edwards EnterpriseOne Tools.
What type of vulnerability is CVE-2026-46904?
CVE-2026-46904 is categorized as a security vulnerability in the Enterprise Infrastructure Security component.