CVE-2026-46879: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

This is an unauthenticated remote compromise vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically within the Enterprise Infrastructure Security component, reachable over the network via the JDENET protocol. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the service is exposed over the network, requires no credentials, no victim interaction, and the exploit is reliable with no special conditions. Successful exploitation results in full takeover of JD Edwards EnterpriseOne Tools, giving an attacker complete control over confidentiality, integrity, and availability. No fix versions have been published by Oracle; HarborGuard tracks this advisory and will make a patched rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne Tools service over the network via the JDENET protocol; no local or physical access is required.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerability is exploitable by any unauthenticated network peer.

• Victim interactionNot required

  No user action, click, or session is needed; the attacker initiates exploitation entirely without victim participation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• A successful attacker gains full read access to all data processed by JD Edwards EnterpriseOne Tools, including ERP records, configuration secrets, and user credentials stored or cached by the platform.
• The attacker can write, modify, or delete persistent data managed by the Tools layer, including business-critical ERP transactions and system configuration.
• The attacker can crash or otherwise take the JD Edwards EnterpriseOne Tools service offline, disrupting ERP operations for all users of the affected instance.
• Because the outcome is described as full platform takeover, the attacker can establish persistent access, pivot to connected backend systems, or deploy arbitrary code within the container or host environment.