CVE-2026-46912: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until a vendor fix is applied, restrict network access to JD Edwards EnterpriseOne Tools HTTP endpoints: implement firewall/ACL rules or WAF policies to allow only trusted management IPs/subnets and block all other external HTTP access.
- Compensating control
If practical, isolate affected JD Edwards EnterpriseOne Tools instances from untrusted networks (remove from public network, place behind VPN, or place in a segmented management network) until remediation is complete.
- Operational
Identify and inventory all Oracle JD Edwards EnterpriseOne Tools (Web Runtime Security) instances and determine their versions. Specifically locate any installations in the affected range 9.2.0.0 - 9.2.26.2 and document network exposure (HTTP endpoints) and connected systems.
- Operational
Assume potential compromise for any affected instances. Rotate any administrative and service account credentials that could have been accessed and invalidate sessions/keys associated with affected systems.
- Operational
Perform enhanced logging and security monitoring on affected systems: review access logs, application logs, and database logs for suspicious activity (unauthorized reads/writes/deletes), and retain forensic evidence if compromise is suspected.
- Operational
Monitor Oracle security advisories and vendor communications for a security patch or fixed version for JD Edwards EnterpriseOne Tools (Web Runtime Security). Plan to apply vendor-supplied fixes as soon as they are published and tested in your environment.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46912?
The severity of CVE-2026-46912 is critical with a CVSS score of 9.3.
How do I fix CVE-2026-46912?
To fix CVE-2026-46912, users should update to a patched version of Oracle JD Edwards EnterpriseOne Tools that is not affected by this vulnerability.
What type of vulnerability is CVE-2026-46912?
CVE-2026-46912 is an information leak vulnerability that allows unauthorized data exposure.
Who is affected by CVE-2026-46912?
Users of Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 are affected by CVE-2026-46912.
What can an attacker do with CVE-2026-46912?
An unauthenticated attacker with network access can exploit CVE-2026-46912 to compromise JD Edwards EnterpriseOne systems.