CVE-2026-46911 affects Oracle JD Edwards EnterpriseOne Project Costing component (Job Costing) version 9.2. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via JDENET to compromise the system. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, with potential scope change impacting additional JD Edwards products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle's June 2026 Critical Security Patch Update includes a patch for this vulnerability among 245 fixes across multiple products. Oracle strongly advises applying these patches promptly. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within JD Edwards EnterpriseOne Project Costing 9.2. The vulnerability also has a scope change effect, potentially impacting additional JD Edwards products. Confidentiality and integrity of data are highly impacted, but availability is not affected. This could lead to significant data compromise and operational impact within affected environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46911. Customers are strongly advised to apply this patch without delay to remediate the vulnerability. Until the patch is applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges from users who do not require them. However, these mitigations may disrupt application functionality. Oracle recommends remaining on actively supported versions and promptly applying security patches.