JD Edwards EnterpriseOne Tools CVE-2026-46909

Exploitation requires only network HTTP reachability to a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 deployment with the Enterprise Infrastructure Security component in its default supported configuration; no authentication, no user interaction, and no special non-default feature toggle are called out by Oracle. The practical limiters are network exposure (the Tools HTTP tier must be reachable from the attacker, which in many deployments is restricted to internal or VPN networks) and being on a still-supported 9.2.x line - 9.2.26.3 or whatever Tools release the June 2026 CPU ships is not vulnerable, and unsupported pre-9.2 releases are outside Oracle's stated scope.

All available signals point to high real-world risk: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity, no-auth, no-interaction attack yielding full takeover, and Oracle's own description characterizes it as 'easily exploitable.' EPSS, KEV, and SSVC data are not provided in the input, so probability-of-exploitation and active-exploitation status cannot be quantified - this is a data gap rather than evidence of low risk. Tags label this 'Information Disclosure,' which conflicts with the vector's High integrity and availability impact and Oracle's 'takeover' language; the tag appears inaccurate and should not be used to downgrade severity. JD Edwards deployments frequently expose HTML/AIS servers to internal networks and sometimes to partners or the internet, making this a credible priority despite the absence of a public POC.

An attacker who can reach a JD Edwards EnterpriseOne Tools HTTP endpoint - for example an exposed HTML Server or AIS Server - sends a crafted HTTP request that bypasses Enterprise Infrastructure Security checks, gaining the equivalent of a privileged Tools session without credentials. From there the attacker can read or alter ERP master data, financial transactions, and security configuration, and pivot into connected database and integration servers. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means weaponization would be straightforward once details are known.