What is the CVSS score of CVE-2026-46913?

CVE-2026-46913 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of JD Edwards EnterpriseOne Tools are affected by CVE-2026-46913?

Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.2) contains a critical vulnerability enabling full system compromise by any user with local host access to the Installation Security…

How to fix or mitigate CVE-2026-46913?

Within 24 hours: Inventory all JD Edwards installations running versions 9.2.0.0-9.2.26.2 and identify which servers host the Installation Security component. Within 7 days: Restrict local logon access to Installation Security component hosts to authorized administrators only; implement network segmentation isolating JD Edwards infrastructure from other critical systems. Within 30 days: Monitor Oracle security advisories for patch release; develop upgrade plan to versions beyond 9.2.26.2 or evaluate disabling the Installation Security component if operationally acceptable.

JD Edwards EnterpriseOne Tools CVE-2026-46913

EUVD-2026-37232 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Oracle's 'logon to the infrastructure' wording means an OS account is required, so PR:L is more honest than PR:N; AV:L, AC:L, S:C and full CIA impact follow the description.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:13 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is achievable by an attacker with local logon access to the host running the Installation Security component, requiring no application credentials. The flaw carries a CVSS 3.1 base score of 9.3 with a scope change, meaning successful exploitation can pivot beyond JD Edwards into adjacent enterprise products on the same infrastructure. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle ranks it as easily exploitable in the June 2026 Critical Patch Update.

Technical ContextAI

The vulnerable component is the Installation Security subsystem of JD Edwards EnterpriseOne Tools (CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools), the runtime and administration layer that underpins JD Edwards EnterpriseOne ERP deployments and handles configuration, package deployment, and security of the application stack. Oracle does not publish a CWE for this advisory, but the combination of Installation Security context, local attack vector, lack of required privileges, and scope change is characteristic of an insecure-permissions or insecure-default-installation weakness (CWE-276/CWE-732 class) where a host-resident principal can manipulate configuration, secrets, or service accounts that the Tools layer trusts. Because Tools sits beneath the EnterpriseOne business applications, compromise of this layer typically grants control over deployed pathcodes, server manager, and connected RDBMS credentials.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle's CPU model means the patch is shipped as the next Tools release after 9.2.26.2 and customers should upgrade to that level or later as the primary remediation. Until the Tools upgrade is staged, restrict interactive and remote logon on the JD Edwards EnterpriseOne Tools host to a minimal set of named ERP administrators by tightening OS group membership, removing shared service accounts, and disabling RDP/SSH for general IT support roles (trade-off: emergency operational support will require break-glass procedures). Audit filesystem and registry permissions on the Tools installation directory and Server Manager configuration to ensure non-administrative local users cannot read or modify configuration, credentials, or installation artifacts, and enable host-based logging of process execution and file changes in those paths so that exploitation attempts are detectable; note that hardening permissions on a running Tools instance may require a service restart.