CVE-2026-46904: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

This is a critical-severity remote compromise vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2), specifically in the Enterprise Infrastructure Security component exposed over the JDENET protocol. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any attacker who can reach the service. Successful exploitation results in full takeover of JD Edwards EnterpriseOne Tools, giving the attacker read, write, and denial-of-service control over the affected system. No fix versions have been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JDENET service over the network; any host with TCP/IP connectivity to the exposed port is a viable attack origin.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, timing windows, or environmental preconditions to succeed.

Blast Radius

• A successful attacker reads all data accessible to the JD Edwards EnterpriseOne Tools process, including configuration secrets, credentials, and business records stored or cached by the application.
• The attacker writes to or modifies application data, configuration, and persisted records, enabling tampering with ERP transactions and system state.
• The attacker can crash or render the JD Edwards EnterpriseOne Tools service unavailable, disrupting dependent business processes.
• Full process-level takeover means the attacker can pivot to other systems reachable from the compromised host using the application's network identity and credentials.