CVE-2026-46903: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security)

Synopsis

This is an authentication-bypass-adjacent privilege escalation vulnerability in the Business Logic Infrastructure Security component of Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.2. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no additional user interaction needed. Successful exploitation gives an attacker full control over the affected JD Edwards EnterpriseOne Tools instance, including complete read, write, and availability impact. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne Tools HTTP endpoint over a network; the service must be accessible from the attacker's position.

• AuthenticationRequired

  A valid low-privilege account is required; any authenticated user on the system can attempt the attack without needing administrative credentials.

• Victim interactionNot required

  No victim interaction is needed; the attacker can carry out exploitation entirely without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental configuration to succeed.

Blast Radius

• A successful attacker reads all data accessible to the JD Edwards EnterpriseOne Tools process, including business records, session tokens, and configuration credentials.
• A successful attacker modifies or deletes persisted business logic data, application configuration, and user records within the affected Tools instance.
• A successful attacker can crash or render the JD Edwards EnterpriseOne Tools service unavailable, disrupting dependent business processes.
• The combination of full confidentiality, integrity, and availability impact means the attacker achieves effective takeover of the application instance.