CVE-2026-46880 is a critical security vulnerability affecting Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 new security patches across multiple products, including JD Edwards EnterpriseOne Tools. The advisory strongly urges customers to apply patches promptly to mitigate exploitation risk. No direct patch link or explicit remediation level is provided in the advisory content, but the update is the authoritative source for remediation.

The vulnerability allows unauthenticated remote attackers to fully compromise JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product, potentially allowing attackers to execute arbitrary code, access sensitive data, and disrupt operations.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required by the attack vector (JDENET) or removing unnecessary privileges from users, though these measures may impact application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.