CVE-2026-46893: Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation)

Synopsis

This is a critical-severity remote code execution vulnerability in Oracle JD Edwards EnterpriseOne General Ledger (component: E1 Foundation), version 9.2. An attacker with a low-privilege account can reach the service over the network via SMB and exploit this flaw without any victim interaction. Successful exploitation results in full takeover of the General Ledger component, with impact extending to additional products in scope due to a CVSS scope change. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network via SMB; the component exposes an over-the-network attack surface (AV:N).

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; no administrative or elevated credentials are needed (PR:L).

• Victim interactionNot required

  No user action, click, or social-engineering step is needed to trigger the vulnerability (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free with no race conditions or special environmental factors required (AC:L).

Blast Radius

• A successful attacker achieves full takeover of JD Edwards EnterpriseOne General Ledger, reading all stored financial records, journal entries, and account data.
• The attacker can modify or delete persisted ledger rows and General Ledger configuration, corrupting financial data integrity.
• The attacker can crash or deny availability of the General Ledger service, halting financial processing workflows.
• Due to the CVSS scope change, other products integrated with the E1 Foundation component are also exposed to the same confidentiality, integrity, and availability impacts.