CVE-2026-46905

Unauthenticated HTTP Remote Code Execution in Oracle JD Edwards EnterpriseOne Tools Web Runtime Security

Published Jun 16, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

The vulnerability resides in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools, where an unauthenticated attacker who can reach the service over HTTP can exploit a flaw to execute arbitrary code. The flaw results in a full compromise of the JD Edwards EnterpriseOne Tools application, leading to loss of confidentiality, integrity, and availability of the underlying business data.

Affected Systems

This flaw affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. Any deployment of these product releases is at risk, regardless of the operating system or database platform, because the vulnerability exists in the web runtime layer of the tools.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 indicates critical severity, and the available EPSS score of <1% suggests that, so far, exploitation attempts have been rare. The flaw can be exploited from any networked host without prior authentication, making it easily reachable by attackers with HTTP access to the JD Edwards instance. Although the vulnerability has not yet been listed in the CISA KEV catalog, its impact warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

JD Edwards EnterpriseOne Tools

affected

Version	Status	Constraints
`9.2.0.0`	affected	≤ 9.2.26.2

Configuration 1 [-]

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Jd Edwards Enterpriseone Tools

Version	Status	Scheme	Platform
`[9.2.0.0,9.2.26.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle security update that addresses this Web Runtime Security issue to versions beyond 9.2.26.2.
Restrict HTTP access to the JD Edwards EnterpriseOne Tools environment to trusted IP ranges and enforce TLS to prevent eavesdropping and man-in-the-middle attacks.
Enable auditing and monitor for suspicious authentication or privilege escalation activity on the tools platform.

Generated by OpenCVE AI on June 18, 2026 at 23:39 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.483% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 19, 2026 12:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTP Remote Code Execution in Oracle JD Edwards EnterpriseOne Tools Web Runtime Security

Jun 18, 2026 10:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	JD Edwards EnterpriseOne Tools Unauthenticated Remote Code Execution via Web Runtime Security
Weaknesses	CWE-284 CWE-287

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		JD Edwards EnterpriseOne Tools Unauthenticated Remote Code Execution via Web Runtime Security
Weaknesses		CWE-284 CWE-287 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle jd Edwards Enterpriseone Tools
CPEs		cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::
Vendors & Products		Oracle Oracle jd Edwards Enterpriseone Tools
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`