Threats Tagged 'cve-2026-46892'

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Human Resources Management accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVE-2026-46878 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via JDENET to fully compromise the EnterpriseOne Tools component. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this and related vulnerabilities in their June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk of takeover. No known exploits in the wild have been reported yet. Mitigation may include blocking network protocols required by the attack and restricting privileges, but these may affect application functionality.