Threats Tagged 'cve-2026-46907'

Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46878 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via JDENET to fully compromise the EnterpriseOne Tools component. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this and related vulnerabilities in their June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk of takeover. No known exploits in the wild have been reported yet. Mitigation may include blocking network protocols required by the attack and restricting privileges, but these may affect application functionality.