PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46904 Oracle Corporation CVE debrief

A critical vulnerability was discovered in JD Edwards EnterpriseOne Tools, specifically in the Enterprise Infrastructure Security component. This vulnerability, tracked as CVE-2026-46904, has a CVSS score of 9.8, indicating a high severity level. The vulnerability is easily exploitable by unauthenticated attackers with network access via JDENET, potentially leading to a takeover of JD Edwards EnterpriseOne Tools. The vulnerability affects versions 9.2.0.0-9.2.26.2 of JD Edwards EnterpriseOne Tools. Organizations should prioritize patching this vulnerability to prevent potential exploitation.

Vendor
Oracle Corporation
Product
JD Edwards EnterpriseOne Tools
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 should prioritize patching this vulnerability to prevent potential exploitation. This involves IT teams responsible for system maintenance, cybersecurity teams that monitor and protect against vulnerabilities, and management teams that oversee system security and compliance. The vulnerability's high severity and potential for exploitation require immediate attention from these groups to ensure the security and integrity of their systems.

Technical summary

The vulnerability is located in the Enterprise Infrastructure Security component of JD Edwards EnterpriseOne Tools, specifically affecting versions 9.2.0.0-9.2.26.2. It allows unauthenticated attackers with network access via JDENET to compromise the system, potentially leading to a complete takeover of JD Edwards EnterpriseOne Tools. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high severity level with a CVSS score of 9.8. Successful exploitation can result in confidentiality, integrity, and availability impacts.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible
  • Restrict network access to JD Edwards EnterpriseOne Tools to only necessary personnel
  • Monitor JD Edwards EnterpriseOne Tools for suspicious activity
  • Consider implementing additional security controls such as multi-factor authentication
  • Review and update system configurations to ensure they align with security best practices
  • Conduct a thorough review of system logs to detect any potential exploitation attempts
  • Implement a change management process to ensure timely application of security patches

Evidence notes

The CVE record was published on 2026-06-17T10:54:08.167Z and was last modified on 2026-06-18T20:50:07.107Z. The NVD entry is currently Analyzed. The vulnerability is located in the Enterprise Infrastructure Security component of JD Edwards EnterpriseOne Tools. The CVE record was created based on information from Oracle Corporation. The NVD provides additional details and analysis of the vulnerability. The vulnerability has a high severity level with a CVSS score of 9.8.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T10:54:08.167Z and has not been modified since then. The NVD entry is currently Analyzed.