CVE-2026-46909 is a critical security vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure Security) affecting versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access over HTTP to compromise the product, potentially leading to full system takeover. The vulnerability has a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its ease of exploitation and severe impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches across multiple products. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols required for exploitation and restricting privileges, though these may affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to fully compromise JD Edwards EnterpriseOne Tools, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to total takeover of the product environment.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and limiting user privileges to only those necessary, though these mitigations may disrupt normal application functionality. Oracle strongly advises remaining on actively supported versions and promptly applying security patches as the primary defense.