JD Edwards EnterpriseOne Tools CVE-2026-46878

The attacker needs network reachability to the JDENET service of a JD Edwards EnterpriseOne Tools instance at version 9.2.0.0 through 9.2.26.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is required against a default JDE deployment. The principal real-world limiter is network exposure of JDENET: in correctly segmented JDE architectures the protocol is restricted to the internal application/database tier, so exploitation requires either a foothold in that tier or a deployment that exposes JDENET to broader networks. There is no platform/OS restriction in the advisory, and the flaw is in the Tools layer so all customer applications running on affected Tools releases are in scope regardless of JDE application version.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents the worst-case profile: remotely reachable, low complexity, no privileges, no user interaction, and full CIA impact - Oracle itself rates it 'easily exploitable.' No EPSS score, CISA KEV listing, public PoC, or SSVC decision data is provided in the input, so real-world exploitation cannot be characterized - the risk signal is currently CVSS- and vendor-driven only. The mitigating factor is deployment topology: JDENET is normally segregated to an internal application tier, so externally exposed risk depends on whether the customer publishes JDE Enterprise Server or HTML Server endpoints to the internet or to a wide trust zone; internet-exposed deployments should be treated as critical, while well-segmented internal deployments are still high-priority but less immediately exploitable.

An attacker on a network with reachability to a JDE Enterprise Server's JDENET listener sends crafted JDENET messages to the Enterprise Infrastructure Security component, bypassing authentication and obtaining control of the Tools layer. From that foothold the attacker can read or alter ERP data, plant persistent JDE objects, or pivot into the database tier the Enterprise Server is authorized against. No public exploit identified at time of analysis, and no user interaction is required.