CVE-2026-46892: Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources)

Synopsis

This is a critical-severity unauthenticated access-control vulnerability in the Human Resources component of Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. The flaw is reachable over HTTP from any network location with no credentials required, and carries a CVSS 3.1 score of 9.1. Successful exploitation gives an attacker full read access to all HR data in the system and the ability to create, modify, or delete any records within the Human Resources module. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne HTTP interface over the network; any host with network access to the service is in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Exploit complexity is low, meaning no race conditions, special memory layout, or non-standard environmental conditions are required for reliable exploitation.

Blast Radius

• Reads all data accessible to the JD Edwards EnterpriseOne HR module, including employee records, compensation details, and personally identifiable information.
• Creates, modifies, or deletes critical HR records such as employee profiles, payroll data, and organizational structure entries.
• Provides complete data-level access to every record the Human Resources component can reach, with no partial-access limitation.
• Integrity loss extends to audit trails and HR transactions, enabling an attacker to cover modifications or inject false records.