CVE-2026-46910 affects Oracle JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.2. The vulnerability allows unauthenticated remote attackers to access critical data or cause a complete denial of service via network access over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates that the attack requires no privileges or user interaction and can be exploited remotely with low complexity, resulting in high confidentiality and availability impacts. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update. The vendor strongly recommends applying the patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk but could disrupt application functionality. No public exploits are known at this time.

Successful exploitation can lead to unauthorized access to critical data within JD Edwards EnterpriseOne Tools or cause the application to hang or crash repeatedly, resulting in a complete denial of service. This impacts confidentiality and availability of the affected system. No integrity impact is indicated. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of attack.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.