CVE-2026-46905: JD Edwards EnterpriseOne Auth Bypass

CVE-2026-46905 Overview

CVE-2026-46905 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools affecting the Web Runtime Security component. The flaw allows an unauthenticated remote attacker to compromise the application over HTTP without user interaction. Supported versions 9.2.0.0 through 9.2.26.2 are affected.

Successful exploitation results in full takeover of JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can take over JD Edwards EnterpriseOne Tools deployments through a low-complexity HTTP request, exposing ERP data and business processes.

Affected Products

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2
Web Runtime Security component
Deployments exposing JD Edwards web services over HTTP/HTTPS

Discovery Timeline

2026-06-17 - Oracle publishes Security Alert advisory CPUJUN2026
2026-06-17 - CVE-2026-46905 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46905

Vulnerability Analysis

The vulnerability resides in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools. The component fails to enforce authentication on a critical function reachable over the network. An attacker only needs HTTP access to the target service to trigger the flaw.

The issue maps to CWE-306: Missing Authentication for Critical Function. Because the affected code path bypasses identity validation, an attacker gains the same execution context as a legitimate privileged user. This grants control over the application and access to backend data managed by the ERP platform.

EPSS data from 2026-06-18 places the exploitation probability at 0.45 percent at the 35.7 percentile. No public proof-of-concept code has been published at the time of writing.

Root Cause

The Web Runtime Security component does not require authentication before executing a sensitive operation. Functions that should validate session tokens or credentials accept requests from anonymous clients. This is a direct instance of CWE-306, where a security-critical action lacks an access control gate.

Attack Vector

The attacker sends a crafted HTTP request to an exposed JD Edwards EnterpriseOne Tools endpoint. No credentials, prior access, or user interaction is required. Internet-facing deployments and flat internal networks both expose the service to compromise. Refer to the Oracle Security Alert June 2026 for vendor-published technical details.

No verified exploitation code is available. The vulnerability mechanism is described in prose above to avoid speculation.

Detection Methods for CVE-2026-46905

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to JD Edwards EnterpriseOne Tools endpoints from unexpected source addresses
New or modified administrative accounts within JD Edwards EnterpriseOne Tools
Unusual outbound connections originating from the JD Edwards application or web server tier
Web server access logs showing successful responses to requests lacking session cookies or authentication headers

Detection Strategies

Inspect web access logs for requests to JD Edwards EnterpriseOne Tools URIs that return successful responses without authentication tokens
Alert on configuration changes, user provisioning events, or privilege modifications within JD Edwards audit logs
Correlate HTTP traffic anomalies with process execution on the application server to identify post-exploitation activity

Monitoring Recommendations

Forward web server, application, and operating system logs to a centralized SIEM for correlation
Baseline normal request patterns against the Web Runtime Security component and alert on deviations
Monitor outbound network activity from the JD Edwards tier for command-and-control indicators

How to Mitigate CVE-2026-46905

Immediate Actions Required

Apply the patches documented in the Oracle Security Alert June 2026 to all affected JD Edwards EnterpriseOne Tools instances
Restrict network access to JD Edwards EnterpriseOne Tools interfaces to trusted management networks only
Audit existing JD Edwards user accounts, roles, and recent administrative changes for signs of abuse
Review historical web server logs for unauthenticated access attempts predating patch deployment

Patch Information

Oracle released fixes as part of the June 2026 Critical Patch Update. Administrators must upgrade JD Edwards EnterpriseOne Tools beyond version 9.2.26.2 using the packages referenced in the Oracle Security Alert June 2026. Apply the update in a staging environment before production rollout.

Workarounds

Place JD Edwards EnterpriseOne Tools behind a reverse proxy or web application firewall that enforces authentication at the edge
Block external HTTP access to the Web Runtime Security component until patches are applied
Enforce network segmentation so that only application administrators can reach the management interfaces

bash

# Example firewall restriction limiting JD Edwards web access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP