JD Edwards EnterpriseOne CVE-2026-46891

Exploitation requires (1) network reachability to the JD Edwards EnterpriseOne HTML/web tier over HTTP, and (2) a valid low-privileged EnterpriseOne user account (PR:L) - any authenticated user, not necessarily an Accounts Payable role-holder, suffices per Oracle's description that a low-privileged attacker can compromise the AP component. The deployment must be running EnterpriseOne 9.2 with the Accounts Payable module enabled and reachable. Limiting factors: an attacker without any EnterpriseOne credential cannot exploit this directly despite the 'Authentication Bypass' feed tag (CVSS PR:L contradicts a fully unauthenticated reading); environments that isolate EnterpriseOne behind VPN/SSO and enforce least-privilege role assignments reduce the realistic attacker pool, and availability is not impacted (A:N) so denial-of-service is not part of the attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N corroborates Oracle's 'easily exploitable' wording: any low-privileged EnterpriseOne user with HTTP reach can drive the attack with no user interaction. The lack of availability impact and the unchanged scope keep this below a 9.x rating, but the High confidentiality and integrity impacts on financial AP data make it materially severe for finance-heavy enterprises. EPSS and KEV signals are not provided in the input - neither active exploitation nor an exploitation probability can be confirmed, and no public exploit is identified at time of analysis, so urgency rests on the CVSS profile, the credential-light precondition, and Oracle's own assessment. The 'Authentication Bypass' tag in the feed is at odds with PR:L in the CVSS vector (which requires some privileges); treat the tag as a category hint rather than confirmation that the flaw can be reached fully unauthenticated, and verify with Oracle's CPU notes.

A low-privileged JD Edwards user - for example an internal employee with any non-AP role, or an attacker who has phished a basic EnterpriseOne credential - sends crafted HTTP requests to AP endpoints on the EnterpriseOne HTML Server and gains read/write access to supplier and voucher data the user was never granted. The attacker can exfiltrate vendor master and payment data or, more damagingly, create or modify vouchers to redirect payments, with no user interaction required and no public exploit identified at time of analysis.