JD Edwards EnterpriseOne Tools CVE-2026-46882

Exploitation requires network reachability to the JDENET protocol port of an Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 enterprise server; no authentication, no user interaction, and no special non-default configuration are required per the AV:N/AC:L/PR:N/UI:N vector and Oracle's 'easily exploitable' phrasing. The practical limiting factor is that JDENET is intended for intra-cluster JDE traffic, so risk is highest where the enterprise server's JDENET port is exposed to the internet, to general corporate user networks, or to compromised internal hosts; deployments that confine JDENET to a hardened back-end VLAN sharply reduce, but do not eliminate, the reachable attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the worst-case profile: network-reachable, no authentication, no user interaction, and full CIA impact - Oracle's own text reinforces this with 'easily exploitable' and 'takeover.' There is no EPSS score, no SSVC decision, no POC reference, and no CISA KEV entry provided, so exploitation telemetry is absent and the score is currently a capability rating rather than evidence of mass exploitation. The 'Information Disclosure' tag in the source feed conflicts with the C:H/I:H/A:H takeover impact described by Oracle - the vendor text should be considered authoritative and the tag treated as a feed-level mislabel. Because JDENET is typically only intended to be reachable from internal JDE tiers, real-world exposure depends heavily on whether the enterprise server's JDENET port is reachable from untrusted networks; internet-exposed JDE deployments should be considered urgent.

An attacker with TCP reach to a JDE enterprise server's JDENET port sends a crafted JDENET message to the Enterprise Infrastructure Security component and, without supplying credentials or requiring any user action, gains full control of the JD Edwards EnterpriseOne Tools instance. From that foothold the attacker can read or modify ERP data - finance, HR, supply chain - and pivot to back-end databases that the JDE service account can reach. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording suggests low engineering effort once the protocol details are reversed.