CVE-2026-46878

Critical · CVSS 9.8

JD Edwards EnterpriseOne Tools — Improper Access Control (Unauthenticated Network Takeover via JDENET)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-284

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols JDENETEnterpriseOne ToolsEnterprise Infrastructure SecurityJDE_NETjdenet_kernelJDENetE1JDENetProtocol

Keywords CVE-2026-46878JD Edwards EnterpriseOne ToolsJDENETOracle JDE RCEJDE EnterpriseOne unauthenticatedEnterprise Infrastructure Security exploitJDE takeover PoCOracle JD Edwards 9.2 vulnerabilityCWE-284 JDE

Versions: 9.2.0.0 - 9.2.26.2

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T00:00:04.000Z · profiled 2026-06-19T00:30:04.000Z