CVE-2026-46913: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security)

Synopsis

A critical local-privilege vulnerability exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools, affecting versions 9.2.0.0 through 9.2.26.2. An unauthenticated attacker with a local session on the host where EnterpriseOne Tools runs can exploit this flaw without any credentials or user interaction. Successful exploitation gives the attacker full control over the JD Edwards EnterpriseOne Tools installation, with impact that extends beyond the product itself due to a CVSS scope change. No fix version has been published; HarborGuard tracks the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host where JD Edwards EnterpriseOne Tools executes; no network path to the service is required.

• AuthenticationNot required

  No credentials of any kind are needed; the CVSS vector specifies PR:N, meaning an unauthenticated local session is sufficient to attempt exploitation.

• Victim interactionNot required

  The exploit completes without any action from another user or administrator on the system.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no specific race condition, memory layout dependency, or other environmental prerequisite.

Blast Radius

• A successful attacker achieves full takeover of JD Edwards EnterpriseOne Tools, reading all data the process has access to, including configuration secrets, credentials stored by the installer, and application data.
• The attacker can modify or delete persisted application data, configuration files, and installation artifacts managed by the Tools component.
• The affected service and any dependent processes can be crashed or made unavailable, disrupting ERP operations reliant on EnterpriseOne Tools.
• Due to a CVSS scope change, the attacker can pivot and affect additional products or services running on the same infrastructure beyond the JD Edwards process itself.