CVE-2026-46904 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure Security) affecting versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the product, potentially leading to full takeover. The vulnerability is rated with a CVSS 3.1 base score of 9.8, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability among others. Oracle strongly recommends applying these patches without delay. Mitigation options before patching include blocking required network protocols and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access can leverage this flaw to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the security patches as soon as possible to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (such as JDENET) and by removing unnecessary privileges or access to certain packages from users who do not require them. Note that these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security patches.