This vulnerability affects Oracle JD Edwards EnterpriseOne Accounts Payable version 9.2 and is easily exploitable by a low privileged attacker with network access over HTTP. The vulnerability allows compromise of the Accounts Payable component, with potential scope change impacting additional products. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state a dedicated patch for CVE-2026-46908. Oracle recommends applying the Critical Security Patch Update without delay to mitigate risks.

Successful exploitation can lead to complete takeover of the JD Edwards EnterpriseOne Accounts Payable component, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other related Oracle products may also be impacted. This could result in significant operational disruption and data compromise within affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to vulnerable packages from users. However, these workarounds may impact application functionality. Oracle's advisory does not explicitly confirm a dedicated patch for this CVE, so customers should monitor the vendor advisory for updates and apply all relevant patches promptly.