What is the CVSS score of CVE-2026-46903?

CVE-2026-46903 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46903?

Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.2) contains a critical vulnerability enabling low-privileged authenticated users to achieve complete takeover of the application,…

How to fix or mitigate CVE-2026-46903?

24 hours: Identify all JD Edwards EnterpriseOne Tools instances running versions 9.2.0.0-9.2.26.2; restrict network access to corporate VPN/trusted networks only; enable comprehensive audit logging for all administrative and authentication events. 7 days: Contact Oracle for patched release timeline and interim security guidance; assess impact scope across finance, supply chain, and operations teams; implement network segmentation to isolate critical instances. 30 days: Deploy patched version when Oracle releases fix beyond 9.2.26.2; if unavailable, establish compensating controls roadmap with documented sign-off from executive sponsors acknowledging residual risk.

JD Edwards EnterpriseOne Tools CVE-2026-46903

EUVD-2026-37222 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable Tools endpoint gives AV:N/AC:L, a valid low-privileged JDE account is required so PR:L/UI:N, and full takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:19 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible via the Business Logic Infrastructure Security component, where a low-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability of the application. Oracle rates the issue 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis. The flaw is described as easily exploitable, making it a high-priority patch target for enterprises running affected Tools releases.

Technical ContextAI

JD Edwards EnterpriseOne Tools provides the runtime, security, and middleware layer for the JD Edwards EnterpriseOne ERP suite, and the affected component - Business Logic Infrastructure Security - is the framework that enforces authorization and security controls around business function execution over HTTP. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools covers the Tools product across the 9.2 line. CWE is not assigned, but the combination of low privileges, no user interaction, network HTTP vector, and full CIA impact is consistent with an authorization-bypass or privilege-escalation flaw inside the Tools security layer that lets an authenticated user invoke or manipulate business logic they should not control.

RemediationAI

Apply the fix delivered in Oracle's June 2026 Critical Patch Update for JD Edwards as documented at https://www.oracle.com/security-alerts/cspujun2026.html, upgrading EnterpriseOne Tools beyond the affected 9.2.0.0-9.2.26.2 range to the patched Tools release Oracle ships in that CPU (exact post-9.2.26.2 fix level should be taken from the Oracle advisory rather than assumed). Until patching, restrict HTTP access to the EnterpriseOne Tools web tier to trusted internal networks via firewall or reverse-proxy ACLs, tighten role assignments so that low-privileged business accounts cannot reach the Business Logic Infrastructure Security endpoints, and enforce MFA and credential hygiene to make the PR:L precondition harder to satisfy; note that network restrictions can block legitimate remote users and that role tightening may disrupt business function execution and should be staged.