CVE-2026-46908

Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Accounts Payable. While the vulnerability is in JD Edwards EnterpriseOne Accounts Payable, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Accounts Payable. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cspujun2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:jd_edwards_enterpriseone_accounts_payable:9.2:*:*:*:*:*:*:*

History

26 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto JD Edwards EnterpriseOne Cuentas por Pagar de Oracle JD Edwards (componente: Cuentas por Pagar). La versión compatible afectada es la 9.2. Una vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios y acceso a la red a través de HTTP comprometer JD Edwards EnterpriseOne Cuentas por Pagar. Aunque la vulnerabilidad está en JD Edwards EnterpriseOne Cuentas por Pagar, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de JD Edwards EnterpriseOne Cuentas por Pagar. Puntuación Base CVSS 3.1 9.9 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Information

Published : 2026-06-17 10:54

Updated : 2026-10-26 12:10

NVD link : CVE-2026-46908

Mitre link : CVE-2026-46908

CVE.ORG link : CVE-2026-46908

JSON object : View

Products Affected

oracle

jd_edwards_enterpriseone_accounts_payable

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-46908", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46908", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "JD Edwards EnterpriseOne Accounts Payable", "versions": [{"status": "affected", "version": "9.2", "versionType": "semver"}]}]}], "published": "2026-06-17T10:54:08.610", "references": [{"url": "https://www.oracle.com/security-alerts/cspujun2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Accounts Payable. While the vulnerability is in JD Edwards EnterpriseOne Accounts Payable, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Accounts Payable. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."}, {"lang": "es", "value": "Vulnerabilidad en el producto JD Edwards EnterpriseOne Cuentas por Pagar de Oracle JD Edwards (componente: Cuentas por Pagar). La versi\u00f3n compatible afectada es la 9.2. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios y acceso a la red a trav\u00e9s de HTTP comprometer JD Edwards EnterpriseOne Cuentas por Pagar. Aunque la vulnerabilidad est\u00e1 en JD Edwards EnterpriseOne Cuentas por Pagar, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de JD Edwards EnterpriseOne Cuentas por Pagar. Puntuaci\u00f3n Base CVSS 3.1 9.9 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."}], "lastModified": "2026-10-26T12:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_accounts_payable:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7684CBEF-5712-4409-B231-9F7714E3EFB3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}