What is the CVSS score of CVE-2026-46908?

CVE-2026-46908 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-46908?

Oracle JD Edwards EnterpriseOne Accounts Payable 9.2 is vulnerable to remote system takeover that compromises financial operations and adjacent connected systems.

How to fix or mitigate CVE-2026-46908?

24 hours: Inventory all Oracle JD Edwards 9.2 AP systems in your environment and restrict network access to administrative personnel only. 7 days: Establish contact with Oracle Support regarding patch timeline; implement network segmentation to isolate AP systems from general corporate networks. 30 days: Deploy vendor patch when released and verify successful remediation across all affected instances.

JD Edwards EnterpriseOne CVE-2026-46908

EUVD-2026-37227 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Jd Edwards Enterpriseone Accounts Payable Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Oracle's description supports network HTTP exploitation (AV:N/AC:L), a low-privileged account (PR:L), no user interaction, scope change into adjacent products, and full takeover of the AP module (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:16 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Accounts Payable. While the vulnerability is in JD Edwards EnterpriseOne Accounts Payable, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Accounts Payable. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle JD Edwards EnterpriseOne Accounts Payable 9.2 is possible by a low-privileged remote attacker over HTTP, with scope-changing impact on adjacent products. The CVSS 3.1 base score of 9.9 reflects full confidentiality, integrity, and availability compromise plus a scope change (S:C), and no public exploit identified at time of analysis. Oracle disclosed the issue in its June 2026 Critical Patch Update (CPU).

Technical ContextAI

The affected component is the Accounts Payable module of Oracle JD Edwards EnterpriseOne, an ERP suite used for financial and procurement workflows. Per the CPE string, only the Accounts Payable application (cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_accounts_payable) is in scope, and Oracle identifies version 9.2 as affected. No CWE is assigned by Oracle, but the CVSS scope change (S:C) combined with HTTP-based exploitation and low-privilege requirements is characteristic of authorization or input-handling flaws in EnterpriseOne's web-tier servlets that pivot into the broader Tools/HTML Server stack and downstream EnterpriseOne services.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to JD Edwards EnterpriseOne 9.2 environments at the earliest scheduled maintenance window. Until patching is possible, restrict network reachability of the EnterpriseOne HTML/Web Server tier to trusted internal networks via firewalling or VPN, audit and prune low-privileged accounts (especially dormant AP clerk and vendor portal accounts), enforce MFA on EnterpriseOne authentication where supported, and monitor HTTP request logs for anomalous activity against Accounts Payable endpoints - these compensating controls reduce attack surface but do not eliminate risk for any insider or compromised low-privileged session and may break legitimate remote AP workflows.