CVE-2026-46905: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security)

Synopsis

An authentication bypass (or equivalent critical security flaw) in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with HTTP network access to fully compromise the affected system. The vulnerability is reachable over the network with no credentials and no user interaction required, making it trivially exploitable at scale. Successful exploitation gives the attacker complete control over the JD Edwards EnterpriseOne Tools instance, including full read, write, and availability impact. No fix version has been published yet; HarborGuard tracks the upstream Oracle advisory and will surface a patched-image rebuild the moment one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the JD Edwards EnterpriseOne Tools HTTP service over the network; any internet- or intranet-exposed instance is directly in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely anonymous attacker.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit works entirely server-side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and repeatable with no dependency on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• The attacker achieves full takeover of the JD Edwards EnterpriseOne Tools instance, gaining the ability to read all data the application can access, including financial records, supply chain data, and user credentials stored or processed by the ERP platform.
• The attacker can modify or delete persisted application data, including business transactions, configuration, and user account information.
• The attacker can crash or render the JD Edwards EnterpriseOne Tools service unavailable, disrupting ERP operations and dependent business processes.
• With full system-level compromise, the attacker may use the host as a pivot point to reach adjacent internal systems that trust the ERP server.