CVE-2026-46909: Critical severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to JD Edwards EnterpriseOne Tools' HTTP interface so it is accessible only from trusted hosts/networks (for example, via firewall rules, network ACLs, or a WAF). Do not expose the HTTP management interface to the public internet.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46909?
CVE-2026-46909 has a critical severity rating of 9.8.
How do I fix CVE-2026-46909?
To address CVE-2026-46909, update your Oracle JD Edwards EnterpriseOne Tools to a version beyond 9.2.26.2.
Who is affected by CVE-2026-46909?
CVE-2026-46909 affects users of Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2.
What type of access is needed to exploit CVE-2026-46909?
CVE-2026-46909 can be exploited by an unauthenticated attacker with network access via HTTP.
What are the consequences of CVE-2026-46909?
Exploitation of CVE-2026-46909 could lead to significant security compromises including unauthorized access and data breaches.