CVE-2026-46910: Input Validation
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or unbind HTTP access for JD Edwards EnterpriseOne Tools, or restrict it to internal/management network interfaces only. If HTTP access is required, configure the product to only listen on internal interfaces and allow access solely from trusted management IPs or via an authenticated VPN.
JD Edwards EnterpriseOne Tools (Enterprise Infrastructure Security) HTTP access = disabled or restricted to management network - Compensating control
Restrict network access to JD Edwards EnterpriseOne Tools HTTP ports at the perimeter and internal firewalls/ACLs so that only trusted management IPs and networks can reach the service; block access from untrusted networks and the public Internet.
- Compensating control
Deploy WAF or intrusion prevention controls in front of JD Edwards EnterpriseOne Tools HTTP endpoints and create rules to detect and block exploit attempts targeting the application.
- Operational
Monitor HTTP access logs and security telemetry for signs of exploitation, isolate and investigate any suspected compromises, and perform incident response as needed. Apply vendor-provided patches or updates for JD Edwards EnterpriseOne Tools as soon as they are published.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46910?
The severity of CVE-2026-46910 is critical with a score of 9.1.
How do I fix CVE-2026-46910?
To fix CVE-2026-46910, you must apply the recommended security patches provided by Oracle for affected versions.
What are the affected versions for CVE-2026-46910?
The affected versions for CVE-2026-46910 are Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.2.
Who can exploit CVE-2026-46910?
CVE-2026-46910 can be exploited by unauthenticated attackers with network access via HTTP.
What types of vulnerabilities does CVE-2026-46910 involve?
CVE-2026-46910 involves input validation and potential information leakage.