JD Edwards EnterpriseOne CVE-2026-46907

Attacker must reach the JD Edwards EnterpriseOne Order Promising HTTP interface over the network and possess a low-privileged authenticated account on the JD Edwards EnterpriseOne environment (PR:L), with no user interaction required. The affected deployment must be running JD Edwards EnterpriseOne Order Promising 9.2 with the Order Promising Integration component enabled and reachable. Limiting factors that reduce realistic risk: PR:L means fully anonymous internet exploitation is not possible - the attacker needs at least a low-tier JDE credential - and exposure is bounded by whether the Order Promising Integration HTTP endpoint is reachable from attacker-controlled networks (many JDE deployments restrict it to internal or partner segments).

The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - a near-maximum score driven by network reachability, low attack complexity, only low privileges required, no user interaction, and a scope change with high CIA impact. EPSS data and SSVC decision values are not provided in the input, and the CVE is not listed in CISA KEV, so real-world exploitation pressure cannot be quantitatively confirmed. There is also no published POC at this time. However, JD Edwards is a high-value enterprise target and historically ERP advisories from Oracle CPU/CSPU cycles attract opportunistic scanning within weeks, so the absence of EPSS or KEV signals should not be treated as low risk - it should be treated as priority remediation pending the Oracle CSPU June 2026 cycle.

An attacker who has obtained or compromised a low-privileged JD Edwards EnterpriseOne user account sends crafted HTTP requests to the Order Promising Integration endpoints on the application server. Because the flaw produces a CVSS scope change, the exploitation pivots from Order Promising into other connected JD Edwards components, ultimately achieving full takeover of Order Promising and high-impact effects on adjacent modules. No public exploit identified at time of analysis, but the low complexity (AC:L) and only low-privilege requirement make this attractive once details are reverse-engineered from the Oracle patch.