CVE-2026-46878: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

This is a critical-severity authentication bypass and full-system takeover vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2), specifically in the Enterprise Infrastructure Security component. An unauthenticated attacker with network access to the JDENET protocol interface can reach the vulnerable service without any credentials or victim interaction. Successful exploitation results in a complete takeover of the EnterpriseOne Tools instance, including full read, write, and availability impact. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable JDENET service over the network; any host with network access to the exposed port can attempt exploitation.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a fully unauthenticated attacker.

• Victim interactionNot required

  No action from any user or administrator is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• A successful attacker reads all data accessible to the EnterpriseOne Tools service, including configuration secrets, stored credentials, and any business records the application holds.
• The attacker writes to or modifies persisted application data, configuration, and any database rows the service has access to.
• The attacker crashes or fully disrupts the EnterpriseOne Tools service, denying access to all users depending on it.
• The combination of full confidentiality, integrity, and availability impact constitutes a complete takeover of the affected EnterpriseOne Tools instance.