CVE-2026-46908: Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable)

Synopsis

A critical vulnerability in the Accounts Payable component of Oracle JD Edwards EnterpriseOne version 9.2 allows a low-privileged attacker to reach the system over HTTP and fully compromise the affected product. No authentication beyond a basic user account is needed, and exploitation is straightforward, with successful attacks resulting in complete takeover of the Accounts Payable system and potential cascading impact on additional connected products. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JD Edwards EnterpriseOne Accounts Payable service over the network via HTTP; the CVSS vector specifies AV:N.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker does not need administrative credentials, only any valid user account on the system (PR:L).

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can exploit this unilaterally (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free with no race conditions or special environmental dependencies required (AC:L).

Blast Radius

• A successful attacker reads all data within the Accounts Payable component, including payment records, vendor details, and any stored credentials or session material.
• The attacker modifies or deletes Accounts Payable records, enabling fraudulent payment entries or destruction of financial audit trails.
• The attacker crashes or degrades the Accounts Payable service, disrupting payment processing operations.
• Because the CVSS scope is changed (S:C), the attacker gains a foothold capable of impacting other products and services integrated with or hosted alongside JD Edwards EnterpriseOne.