CVE-2026-46904

Critical · CVSS 9.8

JD Edwards EnterpriseOne Tools — Improper Access Control / Missing Authentication for Critical Function (Unauthenticated RCE/Takeover via JDENET)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-284, CWE-306

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols JDENETEnterpriseOne ToolsEnterprise Infrastructure SecurityJDEjdenetJDENetE1JD EdwardsCWE-284CWE-306

Keywords CVE-2026-46904JD Edwards EnterpriseOne ToolsJDENET unauthenticatedJDE EnterpriseOne exploitJDE 9.2 RCEOracle JD Edwards takeoverEnterprise Infrastructure Security bypassJDENet exploit PoCJD Edwards unauthenticated accessCVE-2026-46904 PoC

Versions: 9.2.0.0 - 9.2.26.2

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T00:00:04.000Z · profiled 2026-06-19T00:30:04.000Z