What is the CVSS score of CVE-2026-46881?

CVE-2026-46881 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46881?

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical vulnerability enabling unauthenticated remote takeover via the JDENET communications service, with no public…

How to fix or mitigate CVE-2026-46881?

**Within 24 hours:** Inventory all Oracle JD Edwards EnterpriseOne Tools instances running versions 9.2.0.0-9.2.26.2; restrict JDENET communication ports (default TCP 6009) from internet and untrusted networks; apply firewall rules limiting access to trusted internal subnets only. **Within 7 days:** Implement network segmentation requiring VPN or bastion host access to JDENET listeners; deploy enhanced logging and real-time alerting on JDENET connection attempts. **Within 30 days:** Monitor Oracle security advisories for CVE-2026-46881 patch availability and apply immediately upon release; maintain network isolation controls as persistent defense-in-depth layer.

JD Edwards EnterpriseOne Tools CVE-2026-46881

EUVD-2026-37373 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

JDENET is a network service reachable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N); full takeover yields C:H/I:H/A:H with no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:31 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2) is possible by unauthenticated network attackers reaching the JDENET communications service, with no public exploit identified at time of analysis. The flaw resides in the Enterprise Infrastructure Security component and yields full confidentiality, integrity, and availability impact (CVSS 9.8), making any internet- or partner-network-exposed JDENET listener an urgent patching priority.

Technical ContextAI

The affected technology is Oracle JD Edwards EnterpriseOne Tools, the runtime and middleware layer (kernel processes, security server, deployment server) that underpins the JD Edwards EnterpriseOne ERP suite. The attack reaches the system through JDENET, the proprietary inter-process messaging protocol used between EnterpriseOne kernels, enterprise servers, and clients over dedicated TCP ports. The CPE 'cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools' confirms the Tools tier (not the application releases) is impacted. No CWE was assigned by Oracle, but the combination of network vector, no authentication, low complexity, and full takeover is characteristic of authentication-bypass or unsafe-deserialization/command-injection classes commonly found in legacy binary middleware protocols.

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update for June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle has not published an exact fixed Tools release in the provided data, so the patch should be obtained directly from My Oracle Support and verified against the CPU advisory. Until patching, restrict network access to JDENET ports (default 6015-6017 plus configured kernel ports) so they are reachable only from trusted EnterpriseOne enterprise/deployment servers and administrative jump hosts, using host firewalls or network ACLs - this preserves normal client/server traffic but will break any user workstations or integrations that connect directly to JDENET, so allow-list those explicitly. Monitor JDENET listeners for anomalous connections and unexpected child processes on enterprise servers as a detective control.