CVE-2026-46907: Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration)

Synopsis

A critical-severity vulnerability affects the Order Promising Integration component of Oracle JD Edwards EnterpriseOne Order Promising version 9.2. The flaw is reachable over the network via HTTP and requires only a low-privileged account to exploit, with no victim interaction needed. Successful exploitation gives an attacker full control of the affected system, including complete read, write, and availability impact that can spill across to other products in the environment (a scope change in CVSS terms). HarborGuard is tracking this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards Order Promising Integration service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privileged account is sufficient; no administrative or elevated credentials are required to trigger the vulnerability.

• Victim interactionNot required

  No user action is required; the attacker can exploit the vulnerability entirely on their own without involving any other user.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special conditions such as race windows or specific memory layout requirements.

Blast Radius

• A successful attacker gains full read access to all data handled by JD Edwards EnterpriseOne Order Promising, including order records, customer data, and integration payloads.
• The attacker can modify or delete any data within the compromised component, corrupting order promising workflows and persisted business records.
• The attacker can crash or render the Order Promising Integration service unavailable, disrupting supply-chain and order fulfillment operations.
• Because CVSS scope is Changed, the attacker can pivot to compromise other products and services that share the same environment, multiplying the impact beyond the initial target.