CVE-2026-46910 Oracle Corporation CVE debrief

Who should care

Organizations using JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 should prioritize patching this vulnerability to prevent potential exploitation. This includes reviewing and updating network access controls to limit exposure to the vulnerable component, monitoring JD Edwards EnterpriseOne Tools for suspicious activity, and considering implementing compensating controls to mitigate the risk of exploitation. IT administrators, security teams, and risk management personnel should be aware of the vulnerability and take necessary actions to protect their systems.

Technical summary

The vulnerability is located in the Enterprise Infrastructure Security component of JD Edwards EnterpriseOne Tools. It has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), indicating that it can be exploited over the network with low attack complexity, no privileges required, and no user interaction. Successful exploitation can result in high confidentiality impact and high availability impact. The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by Oracle Corporation as soon as possible
• Review and update network access controls to limit exposure to the vulnerable component
• Monitor JD Edwards EnterpriseOne Tools for suspicious activity
• Consider implementing compensating controls to mitigate the risk of exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-06-17T10:54:08.810Z and was last modified on 2026-06-17T22:58:41.480Z. The NVD entry is currently Analyzed. The vulnerability has been assigned a CVSS score of 9.1, indicating a high severity level. It allows unauthenticated attackers with network access via HTTP to compromise JD Edwards EnterpriseOne Tools, potentially leading to unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. Organizations and users should verify their deployments and apply patches or mitigations as recommended by the vendor.

Official resources