CVE-2026-46891: Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable)

Synopsis

This is an authorization/access-control vulnerability in the Accounts Payable component of Oracle JD Edwards EnterpriseOne version 9.2. An attacker with a low-privilege account can reach the vulnerable component over HTTP from the network and exploit it without any victim interaction. Successful exploitation gives the attacker full read access to all Accounts Payable data and the ability to create, modify, or delete critical records in that module. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne Accounts Payable service over the network via HTTP; the component is exposed at the network level (AV:N).

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the system; unauthenticated access is not sufficient to trigger this vulnerability (PR:L).

• Victim interactionNot required

  No user interaction or social engineering is needed; the attacker exploits the endpoint directly without involving another person (UI:N).

• Attack complexityDetail

  Exploitation is straightforward and reliable under standard conditions, with no race conditions or special environmental setup required (AC:L).

Blast Radius

• Reads all financial records accessible to the Accounts Payable module, including vendor details, invoice history, and payment data.
• Creates, modifies, or deletes critical Accounts Payable records such as vendor accounts, invoices, and payment approvals.
• Provides a foothold for fraudulent payment redirection or vendor-master manipulation within the ERP system.
• Exposes sensitive financial data that may include bank account numbers, tax identifiers, and contract terms stored in the module.