CVE-2026-46904

CriticalCVSS 9.8

Published: 17/06/2026(UTC)Updated: 18/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile — higher than 37% of all known CVEs

Summary

A vulnerability in Oracle's JD Edwards EnterpriseOne Tools product allows an unauthenticated attacker with network access to compromise JD Edwards EnterpriseOne Tools. Versions 9.2.0.0-9.2.26.2 are affected by this easily exploitable vulnerability.

Risk Assessment

An attacker could take over JD Edwards EnterpriseOne Tools, leading to serious threats to the confidentiality, integrity, and availability of data within the organization.

Recommendation

It is recommended to upgrade to the latest version of JD Edwards EnterpriseOne Tools to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).