What is the CVSS score of CVE-2026-46909?

CVE-2026-46909 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

JD Edwards EnterpriseOne Tools CVE-2026-46909

EUVD-2026-37228 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Authentication Bypass Jd Edwards Enterpriseone Tools

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP takeover with full CIA impact, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.8

Analysis Generated

Jun 16, 2026 - 22:15 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated network attackers via HTTP, per Oracle's June 2026 Critical Patch Update. The flaw resides in the Enterprise Infrastructure Security component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) against an internet-reachable ERP tier makes this a high-priority patching target.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime, security, and middleware layer that underpins Oracle's JD Edwards EnterpriseOne ERP suite, providing services such as authentication, session handling, and HTTP-based application delivery (HTML Server, AIS Server, Server Manager). The affected component, Enterprise Infrastructure Security, governs how requests are authenticated and authorized before reaching business logic. While no CWE is published, the combination of pre-authentication HTTP access and full CIA impact is consistent with an authentication-bypass or unauthenticated remote code execution weakness in the security gating layer rather than a downstream business-logic bug. The single CPE provided (cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools) confirms the Tools framework itself is in scope, not specific application modules.

RemediationAI

Apply the fixes shipped in Oracle's Critical Patch Update for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); the CPU contains the Tools update that supersedes 9.2.26.2 - administrators should consult the CPU advisory matrix for the exact target Tools release applicable to their environment, as no fixed version is independently confirmed in the input data beyond 'patch available per vendor advisory.' Until the CPU is applied, restrict network reachability of the JD Edwards HTML Server, AIS Server, and Server Manager endpoints to trusted management networks via firewall or reverse-proxy ACLs, and place a WAF in front of internet- or partner-facing JDE web tiers to filter anomalous HTTP requests - note that AIS REST clients and integrations may break if allowlists are too narrow. Increase logging on the Tools HTTP listeners and monitor for unauthenticated requests reaching protected paths so that any exploitation attempt while patching is in flight is detectable.