CVE-2026-46907: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. in Oracle Corporation JD Edwards EnterpriseOne Order Promising
CVE-2026-46907 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Order Promising version 9.2. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability, and may also affect additional Oracle products due to scope change. The CVSS 3.1 base score is 9.9, indicating critical severity. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory and strongly recommends applying patches promptly. No specific patch version is stated in the input, but Oracle advises applying the Critical Security Patch Update to mitigate the risk. Until patched, risk reduction may be possible by blocking required network protocols or removing unnecessary privileges, though these may impact functionality.
AI Analysis
Technical Summary
This vulnerability affects Oracle JD Edwards EnterpriseOne Order Promising component (version 9.2). It is easily exploitable over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to complete compromise of the Order Promising product and potentially impact other Oracle products (scope change). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products including JD Edwards EnterpriseOne Order Promising 9.2. The advisory strongly urges customers to apply the patches immediately to mitigate the risk. No explicit patch version or fix details are provided in the input, but the vendor advisory is authoritative for patch availability and remediation guidance.
Potential Impact
The vulnerability allows an attacker with network access and low privileges to fully compromise JD Edwards EnterpriseOne Order Promising 9.2, resulting in complete loss of confidentiality, integrity, and availability of the product. The scope change means that exploitation may also affect additional Oracle products beyond Order Promising. This could lead to takeover of the affected system and potentially broader impact within the Oracle product ecosystem.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Customers should apply these patches without delay to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, though these measures may disrupt application functionality. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required.
CVE-2026-46907: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. in Oracle Corporation JD Edwards EnterpriseOne Order Promising
Description
CVE-2026-46907 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Order Promising version 9.2. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability, and may also affect additional Oracle products due to scope change. The CVSS 3.1 base score is 9.9, indicating critical severity. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory and strongly recommends applying patches promptly. No specific patch version is stated in the input, but Oracle advises applying the Critical Security Patch Update to mitigate the risk. Until patched, risk reduction may be possible by blocking required network protocols or removing unnecessary privileges, though these may impact functionality.
CVSS v3.1
Score 9.9critical
Affected software
pkg:maven/com.oracle.jdenterpriseone/order-promisingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle JD Edwards EnterpriseOne Order Promising component (version 9.2). It is easily exploitable over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to complete compromise of the Order Promising product and potentially impact other Oracle products (scope change). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products including JD Edwards EnterpriseOne Order Promising 9.2. The advisory strongly urges customers to apply the patches immediately to mitigate the risk. No explicit patch version or fix details are provided in the input, but the vendor advisory is authoritative for patch availability and remediation guidance.
Potential Impact
The vulnerability allows an attacker with network access and low privileges to fully compromise JD Edwards EnterpriseOne Order Promising 9.2, resulting in complete loss of confidentiality, integrity, and availability of the product. The scope change means that exploitation may also affect additional Oracle products beyond Order Promising. This could lead to takeover of the affected system and potentially broader impact within the Oracle product ecosystem.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Customers should apply these patches without delay to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, though these measures may disrupt application functionality. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.311Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b6250b89be6888265f63
Added to database: 6/16/2026, 8:46:29 PM
Last enriched: 6/16/2026, 9:31:48 PM
Last updated: 6/17/2026, 5:11:14 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.