CVE-2026-46879

Critical · CVSS 9.8

JD Edwards EnterpriseOne Tools — Missing Authentication for Critical Function (CWE-306) leading to unauthenticated RCE / system takeover

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-306

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols JDENETEnterpriseOne ToolsEnterprise Infrastructure SecurityJDEjdenetE1JDENet network protocol

Keywords CVE-2026-46879JD Edwards EnterpriseOne ToolsJDENETunauthenticatedCWE-306missing authenticationOracle JDE exploitEnterpriseOne takeoverJDE RCEOracle JD Edwards PoC

Versions: 9.2.0.0 - 9.2.26.2

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T00:00:04.000Z · profiled 2026-06-19T00:30:04.000Z