JD Edwards EnterpriseOne Tools CVE-2026-46879

The attacker only needs network reachability to the JDENET protocol listener on a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 server; no authentication, no user interaction, and no special non-default configuration is required per the CVSS AV:N/AC:L/PR:N/UI:N vector and Oracle's 'easily exploitable' wording. The principal real-world limiter is network exposure of JDENET: in well-segmented deployments JDENET is reachable only from other EnterpriseOne servers inside a trusted tier, so exploitation typically requires an attacker already inside the corporate network or a misconfiguration that exposes JDENET to broader VLANs or the internet.

All available signals point to high real-world priority: the CVSS 9.8 vector is fully network-reachable, low complexity, no privileges, no user interaction, with H/H/H impact, and Oracle itself flags it 'easily exploitable' and resulting in 'takeover.' EPSS, KEV listing, and SSVC decision data are not provided in the input, so quantitative exploitation probability and automatability cannot be confirmed. No public exploit identified at time of analysis and the CVE is not in CISA KEV, which tempers immediate panic but does not reduce intrinsic severity - JDENET is normally exposed only inside trusted server zones, so internet-exposed risk depends on each customer's network architecture (a meaningful limiting factor not captured by the CVSS network vector). The 'Information Disclosure' tag in the input conflicts with Oracle's 'takeover' wording and the H/H/H impact; trust the CVSS vector and Oracle text over the tag.

An attacker with network reachability to a JD Edwards EnterpriseOne server (for example a foothold on an internal workstation, a compromised business partner VPN, or a misconfigured perimeter exposing JDENET) sends a crafted JDENET message to the kernel listener and gains takeover of the Tools layer without any credentials or user interaction. Given Oracle's 'easily exploitable' framing and AC:L, weaponization should be assumed feasible by a skilled attacker once technical details emerge, even though no public exploit identified at time of analysis.