CVE-2026-21946
Reported by oracle · Published January 20, 2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | JD Edwards EnterpriseOne Tools | 9.2.0.0 |
| Oracle Corporation | JD Edwards EnterpriseOne Tools | 9.2.0.0 |
| oracle | jd_edwards_enterpriseone_tools | 9.2.0.0 |
Timeline
- Jan 17, 2026 CVE Published
- Jan 21, 2026 EPSS Score (30 in total, the first dated here)
- Jan 21, 2026 PoC Published (2 in total, the first dated here)
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-21946
vulnetix vdb fixes CVE-2026-21946Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-21946/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Oracle Advisory vendor-advisory