CVE-2026-46905: Critical severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the JD Edwards EnterpriseOne Tools HTTP interfaces to trusted IPs/networks only. Implement firewall/ACL rules, place the application behind a VPN or WAF, or otherwise block direct Internet HTTP access to the product until a vendor fix is available.
- Operational
If instances were reachable by HTTP or may have been exposed, assume possible compromise: isolate affected systems from the network, collect and preserve logs for investigation, perform incident response, and rotate any credentials, API keys, or secrets used by JD Edwards EnterpriseOne Tools.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46905?
CVE-2026-46905 has a critical severity rating of 9.8.
How do I fix CVE-2026-46905?
To fix CVE-2026-46905, it is recommended to upgrade the Oracle JD Edwards EnterpriseOne Tools to a version higher than 9.2.26.2.
Who can exploit CVE-2026-46905?
CVE-2026-46905 can be exploited by an unauthenticated attacker with network access via HTTP.
What components are affected by CVE-2026-46905?
CVE-2026-46905 affects the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools.
What impact does CVE-2026-46905 have?
CVE-2026-46905 can lead to a total compromise of JD Edwards EnterpriseOne Tools, affecting confidentiality, integrity, and availability.