CVE-2026-46912 is a critical security vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically in the Web Runtime Security component. It affects version 9.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system. The vulnerability can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects a network attack vector with low attack complexity, no privileges or user interaction required, and a scope change impacting confidentiality and integrity severely. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products, including JD Edwards EnterpriseOne Tools. The advisory urges customers to apply patches promptly to mitigate exploitation risk.

Successful exploitation of this vulnerability can result in unauthorized access to all data accessible by JD Edwards EnterpriseOne Tools and unauthorized modification (update, insert, delete) of some of that data. The vulnerability impacts confidentiality and integrity with a critical severity rating (CVSS 9.3). It also has a scope change, meaning it may affect additional Oracle products beyond JD Edwards EnterpriseOne Tools. There is no indication of availability impact. No known exploits in the wild have been reported at the time of this advisory.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing CVE-2026-46912. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack (HTTP) or by removing unnecessary privileges or package access from users, though these measures may impact application functionality. Patch status is not explicitly confirmed for this CVE in the advisory; customers must consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.