CVE-2026-46880: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

A critical unauthenticated network vulnerability exists in the Enterprise Infrastructure Security component of Oracle JD Edwards EnterpriseOne Tools, affecting versions 9.2.0.0 through 9.2.26.2. The flaw is reachable over the network via the JDENET protocol without any credentials or user interaction, meaning any attacker who can reach the service can attempt exploitation. Successful exploitation results in full takeover of JD Edwards EnterpriseOne Tools, giving the attacker read, write, and denial-of-service capability over the affected system. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the JD Edwards EnterpriseOne Tools service over the network via the JDENET protocol; internet- or intranet-exposed deployments are directly at risk.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the service without involving any human on the target side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental setup beyond network access.

Blast Radius

• A successful attacker reads all data accessible to the EnterpriseOne Tools service, including configuration secrets, credentials, and business records.
• The attacker writes to or modifies any data the service can reach, including persisted ERP records and system configuration.
• The attacker crashes or renders the EnterpriseOne Tools service unavailable, disrupting dependent business processes.
• Full system takeover means the attacker can install backdoors or pivot to other systems reachable from the compromised host.