CVE-2026-46891 affects Oracle JD Edwards EnterpriseOne Accounts Payable version 9.2 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in full unauthorized access to all data accessible by the Accounts Payable component. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products. The vendor strongly recommends applying these patches without delay. Until patched, mitigating actions include blocking attack-related network protocols and removing unnecessary privileges, though these may affect application functionality.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within JD Edwards EnterpriseOne Accounts Payable, compromising confidentiality and integrity of all accessible data in this component. There is no reported impact on system availability. Exploitation requires network access via HTTP and low privileges, making it relatively easy to exploit in affected environments. No known exploits in the wild have been reported so far.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them, though these measures may disrupt normal application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.