CVE-2026-46882: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2) in its Enterprise Infrastructure Security component, reachable over the network via the JDENET protocol. No authentication is required and no user interaction is needed, meaning an attacker with network access to the JDENET port can exploit this directly. Successful exploitation results in full takeover of JD Edwards EnterpriseOne Tools, with complete loss of confidentiality, integrity, and availability. No fix versions have been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network via the JDENET protocol; any host with network access to the exposed port is in scope.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  No action from a logged-in user or administrator is required; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or memory layout requirements.

Blast Radius

• A successful attacker gains full control of the JD Edwards EnterpriseOne Tools process, enabling read access to all data it handles including configuration secrets, credentials, and business records.
• The attacker can modify or delete persisted application data, configuration, and any records accessible to the compromised process.
• The attacker can crash or render the JD Edwards EnterpriseOne Tools service completely unavailable.
• Because JDENET is an infrastructure-level protocol, a compromised Tools instance may serve as a pivot point to other connected JD Edwards components and backend systems.