CVE-2026-46903 affects Oracle JD Edwards EnterpriseOne Tools component Business Logic Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows a low privileged attacker with network access over HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 base score is 8.8, indicating high severity with impacts to confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which contains 245 security patches across multiple Oracle products. Oracle strongly advises customers to apply these patches promptly to mitigate the risk. Until patches are applied, risk reduction may be achieved by blocking relevant network protocols and restricting privileges, though these may impact functionality. No public exploits are currently known. The vendor advisory is the authoritative source for patch availability and remediation guidance.

Successful exploitation of this vulnerability can lead to complete compromise of JD Edwards EnterpriseOne Tools, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality. No indication from Oracle that no action is required or that the issue is already mitigated without patching.