CVE-2026-46881: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

This is a critical-severity unauthenticated remote compromise vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure Security component), affecting versions 9.2.0.0 through 9.2.26.2. An attacker with network access to the JDENET protocol endpoint needs no credentials and no victim interaction to exploit this flaw. Successful exploitation results in full takeover of the JD Edwards EnterpriseOne Tools environment, including complete loss of confidentiality, integrity, and availability. No fix versions have been published by Oracle at this time; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network via the JDENET protocol; any host with network access to the exposed port is a viable attack origin.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action or social engineering is required; the attacker interacts directly with the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker reads all data accessible to the JD Edwards EnterpriseOne Tools process, including configuration secrets, credentials, and business records.
• A successful attacker writes to or modifies persisted application data, configuration, and any database rows the Tools process can reach.
• A successful attacker crashes or shuts down the JD Edwards EnterpriseOne Tools service, disrupting all dependent business processes.
• Full process-level takeover means an attacker can pivot to other systems reachable from the compromised host using inherited network trust or stored credentials.