JD Edwards EnterpriseOne Tools CVE-2026-46913

The attacker must already have a valid logon session on the operating-system host where JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 executes - this can be any non-privileged local or remote interactive account (SSH, RDP, console), and no JD Edwards application credentials are required, which is why Oracle scores PR:N despite AV:L. Exploitation is limited to hosts running an affected Tools version with the Installation Security component in its shipped configuration; pure end-user EnterpriseOne web clients with no host access cannot reach the flaw, and environments where the Tools host permits logon only to a small set of ERP administrators sharply reduce the exposed actor population. No user interaction by another principal is required (UI:N), and the scope change means a single host compromise can extend impact to adjacent Oracle products co-located on that infrastructure.

Signals are partially conflicting and should be interpreted carefully: CVSS 9.3 with C:H/I:H/A:H and S:C indicates catastrophic impact, but AV:L confines the attack to actors who already have a local logon on the JD Edwards host, materially reducing the population of capable attackers compared to a network-exposed RCE. AC:L and PR:N indicate that once that foothold exists, exploitation is reliable and needs no application credentials, so this is a strong privilege-escalation/lateral-movement primitive rather than an internet-facing zero-click. EPSS and POC status were not supplied and the CVE is not in CISA KEV, so there is no evidence of active exploitation - the realistic priority is high for organizations whose JD Edwards hosts are multi-tenant, shared with batch operators, or accessible to broad IT support staff, and moderate where host access is already tightly restricted to ERP administrators. Oracle's phrasing 'logon to the infrastructure where JD Edwards EnterpriseOne Tools executes' is broader than a JDE user session and should be confirmed against the June 2026 CPU advisory before scoping mitigations.

A contractor or low-tier IT operator with shell or RDP access to the Windows or Unix host that runs JD Edwards EnterpriseOne Tools abuses an insecure default in the Installation Security component to overwrite or read a privileged Tools artifact, gaining control of the Tools service account. Because the vulnerability has scope change, that control extends into related Oracle products co-resident on the host such as Server Manager, WebLogic deployments, or the configured database connections, yielding full ERP compromise. No public exploit identified at time of analysis, but the combination of AC:L and PR:N means a working technique is likely to be reliable and scriptable once discovered.