What is the CVSS score of CVE-2026-46882?

CVE-2026-46882 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46882?

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 contain a critical vulnerability (CVSS 9.8) enabling unauthenticated remote takeover of ERP infrastructure, affecting confidentiality,…

How to fix or mitigate CVE-2026-46882?

Within 24 hours: Identify and inventory all JD Edwards EnterpriseOne Tools systems running versions 9.2.0.0 through 9.2.26.2 and assess network accessibility of JDENET protocol endpoints. Within 7 days: Implement emergency network segmentation to isolate vulnerable JD Edwards systems and restrict JDENET access to trusted internal networks only; deploy detection signatures for anomalous JDENET traffic. Within 30 days: Apply the Oracle June 2026 Critical Patch Update immediately upon availability; prioritize vulnerable JD Edwards instances for patching and validate patches in non-production environments first.

JD Edwards EnterpriseOne Tools CVE-2026-46882

EUVD-2026-37374 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network exploitation over JDENET with no user interaction and full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:30 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible via the JDENET network protocol, granting full confidentiality, integrity, and availability impact on the ERP middleware. Oracle rates this CVSS 9.8 and describes it as easily exploitable, but at the time of analysis there is no public exploit identified and no CISA KEV listing. Defenders running JD Edwards ERP workloads should treat this as a top-priority patch from the Oracle June 2026 Critical Patch Update.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime, security, and middleware layer beneath Oracle's JD Edwards ERP suite, used for finance, supply chain, and manufacturing operations. The flaw lives in the Enterprise Infrastructure Security component and is reached over JDENET, the proprietary TCP-based message protocol that JDE servers, kernels, and clients use to exchange RPC-like requests between enterprise servers, HTML servers, and Tools clients. CWE is not assigned in the input, but a pre-authentication network protocol bug yielding full takeover is consistent with a deserialization, authentication-bypass, or memory-corruption class defect in the JDENET listener. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools confirms the affected product family across all 9.2.x Tools releases up to 9.2.26.2.

RemediationAI

Apply the fixes from Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) by upgrading JD Edwards EnterpriseOne Tools to the patched 9.2 release listed in that advisory; the input data does not specify a single fixed build number, so consult the CPU patch matrix for the exact target version. Until patching is complete, restrict JDENET listener ports on enterprise servers, HTML servers, and deployment servers to known internal JDE tiers using host firewalls or network ACLs, and ensure JDE infrastructure is not reachable from the internet or untrusted user VLANs - note that over-restricting JDENET will break inter-tier RPC and client-server connectivity, so changes should be scoped per the JDE topology. Increase monitoring on JDENET ports and enterprise server logs for anomalous connections or unexpected kernel spawns while the patch is rolled out.