Threats Tagged 'cve-2026-46910'

CVE-2026-46910 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or cause a denial of service by hanging or crashing the application. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and availability impact. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which contains patches addressing this and other vulnerabilities. Customers are strongly advised to apply the security patches promptly to mitigate the risk. No known exploits in the wild have been reported yet. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, but these mitigations may impact functionality.

CVE-2026-46878 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via JDENET to fully compromise the EnterpriseOne Tools component. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this and related vulnerabilities in their June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk of takeover. No known exploits in the wild have been reported yet. Mitigation may include blocking network protocols required by the attack and restricting privileges, but these may affect application functionality.