CVE-2026-46910: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security)

Synopsis

This is a critical-severity unauthenticated remote vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2), affecting the Enterprise Infrastructure Security component. An attacker reachable over HTTP needs no credentials and no victim interaction to exploit it. Successful exploitation reads all data accessible to the EnterpriseOne Tools instance and crashes or hangs the service entirely. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the EnterpriseOne Tools service over a network via HTTP; any host with HTTP access to the service can attempt exploitation.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action is needed; the attacker sends requests directly to the service without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites.

Blast Radius

• Reads all data accessible to the JD Edwards EnterpriseOne Tools instance, including configuration data, credentials stored within the component, and any application data the service can reach.
• Causes a complete denial of service by crashing or indefinitely hanging the EnterpriseOne Tools process, taking dependent business processes offline until the service is manually restarted.