CVE-2026-46905 is a critical security vulnerability in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools affecting versions 9.2.0.0 through 9.2.26.2. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the system, leading to full takeover of JD Edwards EnterpriseOne Tools. The vulnerability is scored 9.8 on the CVSS 3.1 scale with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for affected products. Until patches are applied, risk reduction may be achieved by blocking attack-related network protocols or limiting user privileges, though these mitigations may disrupt normal operations.

Successful exploitation allows an unauthenticated remote attacker to fully compromise JD Edwards EnterpriseOne Tools, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This could lead to total takeover of the product environment.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches without delay to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by restricting privileges or access to sensitive packages for users who do not need them. However, these mitigations may impact application functionality. Patch status is confirmed by the vendor advisory, which recommends prompt patching.