What is the CVSS score of CVE-2026-46904?

CVE-2026-46904 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46904?

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical vulnerability (CVSS 9.8) enabling unauthenticated remote system takeover with complete confidentiality,…

How to fix or mitigate CVE-2026-46904?

Within 24 hours: Inventory all Oracle JD Edwards EnterpriseOne Tools instances and confirm version numbers; immediately restrict JDENET network service access via firewall to essential business functions only, blocking unauthorized network paths. Within 7 days: Implement network segmentation isolating affected systems to dedicated VLAN; deploy intrusion detection rules for JDENET reconnaissance and exploitation attempts; enable comprehensive audit logging of all access. Within 30 days: Monitor Oracle security advisories for patched JD Edwards versions; develop upgrade timeline and assess feasibility of migration to newer releases; maintain 24/7 monitoring of compensating controls; establish vendor contact for patch availability timeline.

JD Edwards EnterpriseOne Tools CVE-2026-46904

EUVD-2026-37223 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network exploitation via JDENET with full takeover, matching AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:18 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET network service, yielding full confidentiality, integrity, and availability compromise of the platform. Oracle rates the issue CVSS 9.8 and describes it as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

JD Edwards EnterpriseOne Tools is Oracle's ERP middleware tier that hosts the runtime, security kernel, and integration services for JD Edwards EnterpriseOne applications. The vulnerable component, Enterprise Infrastructure Security, is reached via JDENET - the proprietary TCP-based inter-process protocol that EnterpriseOne servers (Enterprise Server, HTML Server, Deployment Server) use to exchange kernel messages, authentication tokens, and application calls. Because the flaw is triggered through JDENET without authentication, the weakness lies in how this protocol handler validates or trusts incoming messages before invoking privileged kernel operations; Oracle has not disclosed a CWE, but the impact profile is consistent with an authentication-bypass or unsafe deserialization/command-handling weakness in the JDENET listener.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update for JD Edwards (https://www.oracle.com/security-alerts/cspujun2026.html); an exact patched Tools release is not enumerated in the provided data, so administrators should consult the CPU matrix to identify the post-9.2.26.2 Tools level applicable to their environment. Until the CPU is deployed, restrict network reachability of the JDENET listener (default TCP 6015 and related kernel ports) to known EnterpriseOne servers and administrative jump hosts using host firewalls or network ACLs, accepting that this will break any out-of-band integrations or remote admin tooling that currently traverse those ports. Monitor JDENET kernel logs and the Server Manager for unexpected connections, anomalous kernel call patterns, or new administrative users, and avoid exposing any EnterpriseOne tier directly to the internet.