CVE-2026-46893 is a critical vulnerability in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (component: E1 Foundation) that allows a low privileged attacker with network access via SMB to compromise the system. The vulnerability has a CVSS 3.1 base score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. Successful exploitation can lead to full takeover of the General Ledger component and may impact other Oracle products. Oracle's June 2026 Critical Security Patch Update includes patches addressing this issue among 245 other security fixes. Oracle strongly urges customers to apply these patches without delay to mitigate the risk. Until patches are applied, risk reduction may be achieved by blocking network protocols used in attacks and restricting unnecessary privileges, though these measures may disrupt application functionality.

Successful exploitation of this vulnerability can result in complete compromise of Oracle JD Edwards EnterpriseOne General Ledger 9.2, affecting confidentiality, integrity, and availability. The attack can be performed remotely over the network via SMB by a low privileged attacker without user interaction. Due to scope change, other Oracle products may also be significantly impacted. The CVSS score of 9.9 indicates critical severity.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (such as SMB) and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via the June 2026 Critical Security Patch Update.