PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46913 Oracle Corporation CVE debrief

A critical vulnerability was discovered in JD Edwards EnterpriseOne Tools, specifically in the Installation Security component. This vulnerability allows an unauthenticated attacker with logon to the infrastructure to compromise JD Edwards EnterpriseOne Tools, potentially leading to a takeover of the system. The vulnerability has a CVSS score of 9.3 and a CVSS Vector of (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Organizations using JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 should prioritize patching this vulnerability to prevent potential takeover of their systems.

Vendor
Oracle Corporation
Product
JD Edwards EnterpriseOne Tools
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 should prioritize patching this vulnerability to prevent potential takeover of their systems. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the risk and implement necessary mitigations.

Technical summary

The vulnerability is located in the Installation Security component of JD Edwards EnterpriseOne Tools. It allows an unauthenticated attacker with logon to the infrastructure to compromise JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS Vector of (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2.

Defensive priority

High priority should be given to patching this vulnerability due to its critical CVSS score and potential impact on the system.

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible
  • Review and update inventory of JD Edwards EnterpriseOne Tools installations
  • Implement compensating controls to monitor and detect potential attacks
  • Verify the integrity of JD Edwards EnterpriseOne Tools installations
  • Review system logs for potential attacks
  • Conduct a thorough risk assessment to identify potential exposure
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-06-17T10:54:09.127Z and was last modified on 2026-06-18T04:16:59.580Z. The NVD entry is currently Analyzed. The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2. Evidence is based on the official CVE record and NVD entry. Defenders should verify the integrity of JD Edwards EnterpriseOne Tools installations and review system logs for potential attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46913 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46913

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46913 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46913

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.