CVE-2026-46912: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security)

Synopsis

This is an authentication bypass and data-exposure vulnerability in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools, affecting versions 9.2.0.0 through 9.2.26.2. An unauthenticated attacker with network access over HTTP can exploit this remotely with no user interaction required, and the scope of impact extends beyond the directly targeted component. Successful exploitation gives the attacker full read access to all data accessible by JD Edwards EnterpriseOne Tools and limited write access to insert, update, or delete some of that data. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne Tools web interface over the network via HTTP; no local or physical access is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are required to trigger this vulnerability.

• Victim interactionNot required

  The attacker does not need to involve or trick any user; the exploit path is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Reads all data accessible to JD Edwards EnterpriseOne Tools, including stored business records, configurations, and potentially session or credential material.
• Inserts, updates, or deletes a subset of JD Edwards EnterpriseOne Tools data, allowing an attacker to tamper with business records or corrupt application state.
• The scope change (S:C) means impact can propagate beyond the directly compromised component to other products or services that trust or consume JD Edwards EnterpriseOne Tools data.
• Availability is not directly impacted, but data integrity and confidentiality losses at this scale can cause effective service disruption through corrupted or stolen business-critical records.