CVE-2026-46913 is a vulnerability in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the JD Edwards EnterpriseOne Tools product. The vulnerability has a CVSS 3.1 score of 9.3 with attack vector local, low attack complexity, no privileges required, no user interaction, and scope change, resulting in high impact on confidentiality, integrity, and availability. Exploitation can lead to complete takeover of the affected product and potentially affect additional Oracle products. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes patches for JD Edwards EnterpriseOne Tools and other affected products. The advisory strongly urges customers to apply the patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in complete compromise of JD Edwards EnterpriseOne Tools, including full confidentiality, integrity, and availability loss. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond JD Edwards EnterpriseOne Tools. This can lead to takeover of the affected systems and potentially broader impact within the affected infrastructure.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk can be partially reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to relevant packages from users who do not need them. These mitigations may impact application functionality, so they should be applied carefully. Patch status is confirmed by the vendor advisory, and applying the official patches is the recommended remediation.