What is the CVSS score of CVE-2026-46880?

CVE-2026-46880 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46880?

Organizations running Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 are exposed to unauthenticated remote takeover of their ERP and financial systems via the JDENET service,…

How to fix or mitigate CVE-2026-46880?

Within 24 hours: Identify all systems running Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2; document JDENET network exposure. Within 7 days: Implement firewall rules and network segmentation restricting JDENET access to necessary systems only; contact Oracle for patch availability and interim guidance. Within 30 days: Apply vendor patches when released; upgrade to unaffected versions or implement permanent network access controls; establish monitoring of JDENET service activity.

JD Edwards EnterpriseOne Tools CVE-2026-46880

EUVD-2026-37372 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Jd Edwards Enterpriseone Tools Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

JDENET is network-reachable (AV:N), Oracle calls it easily exploitable (AC:L), no auth or interaction is needed (PR:N/UI:N), and full takeover of the Tools tier yields C:H/I:H/A:H within the same security authority (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:32 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET communication service over the network. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable; no public exploit identified at time of analysis.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime, middleware, and administration layer underneath Oracle's JD Edwards ERP suite, providing services such as the kernel processes, security server, and JDENET - a proprietary TCP-based inter-process protocol that brokers traffic between EnterpriseOne servers, kernels, and clients. The advisory places the defect in the Enterprise Infrastructure Security component, meaning a security-relevant code path reachable through JDENET fails to properly authenticate or validate requests; while Oracle does not publish a CWE, an unauthenticated network compromise of a security component points to an authentication or message-handling weakness (CWE-287/CWE-306 class) in JDENET. CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools confirms the Tools tier itself, not application objects, is the affected scope.

RemediationAI

Apply the fix shipped in Oracle's June 2026 Critical Patch Update (cspujun2026), which is the vendor channel for this CVE per https://www.oracle.com/security-alerts/cspujun2026.html; an exact fixed Tools release number is not stated in the supplied data, so confirm the target Tools release from the CPU patch matrix before scheduling. Until the patch is deployed, restrict network reachability of the JDENET service ports (default 6015/6016 and the kernel port range) to a hardened allow-list of EnterpriseOne servers and trusted client subnets via firewall or host-based ACLs, and avoid exposing JDENET through VPN split-tunnels or DMZ jump hosts - note that over-restrictive ACLs can break legitimate kernel-to-kernel and Server Manager traffic, so validate against your topology. Increase monitoring on JDENET listeners and JDE security server logs for anomalous unauthenticated session establishment as a detective control until patching is complete.