What is the CVSS score of CVE-2026-46878?

CVE-2026-46878 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46878?

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical remote takeover vulnerability in the JDENET service that enables unauthenticated network attackers to…

How to fix or mitigate CVE-2026-46878?

Within 24 hours: Immediately assess external accessibility of the JDENET service (default port 6009) and restrict network access to internal/VPN sources via firewall rules or network segmentation. Within 7 days: Catalog all affected JD Edwards versions in production, implement enhanced monitoring for exploitation attempts, and document remediation timeline. Within 30 days: Monitor Oracle's security updates for patched versions of 9.2.0.0-9.2.26.2 and execute upgrade plan; consider temporary air-gapping or service disablement for non-critical systems pending patch availability.

JD Edwards EnterpriseOne Tools CVE-2026-46878

EUVD-2026-37370 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated, easily exploitable network takeover via JDENET with full CIA impact, matching AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:33 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated network attackers reaching the JDENET service. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. No EPSS or CISA KEV signal is provided, but the combination of zero prerequisites and full impact warrants priority patching of internet-exposed JDE deployments.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime, security and middleware layer beneath Oracle's JDE ERP suite, hosting enterprise services that JDE clients and servers use to communicate. The vulnerable component is identified by Oracle as 'Enterprise Infrastructure Security' and the attack vector is JDENET, EnterpriseOne's proprietary TCP-based inter-process messaging protocol (default port 15xxx) used between web/HTML servers, enterprise servers and clients. Because JDENET is a custom binary protocol typically deployed inside trusted enterprise segments, vulnerabilities in its authentication, deserialization or message parsing layer historically lead to whole-tier compromise. No CWE has been assigned by Oracle, so the precise root cause class (e.g. deserialization, missing authentication, command injection) cannot be confirmed from the available data, but the 'unauthenticated network takeover via JDENET' phrasing is consistent with an authentication or message-handling defect rather than a memory-corruption issue.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (cspujun2026) per https://www.oracle.com/security-alerts/cspujun2026.html; the specific Tools release version delivering the fix is not enumerated in the provided data and should be confirmed against the CPU patch matrix for your installed Tools release (9.2.0.0-9.2.26.2 are all affected). Until patching is completed, restrict network reachability of JDENET ports between EnterpriseOne tiers (Enterprise Server, HTML/Web Server, Deployment Server, Database Server, and fat clients) to known JDE hosts via firewall/segmentation ACLs, and ensure no JDENET listener is reachable from untrusted networks or the internet - note that overly restrictive ACLs will break legitimate client/server traffic and require an accurate inventory of JDE tier hosts. Monitor JDENET traffic for anomalous connections from non-JDE sources as a compensating detection control.