CVE-2026-46893

Low-Privilege Remote Takeover via SMB in JD Edwards EnterpriseOne General Ledger

Published Jun 16, 2026 CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Analysis

Technical impact

The vulnerability resides in the E1 Foundation component of JD Edwards EnterpriseOne General Ledger, enabling an attacker with low privileges and network access via SMB to compromise the system. The flaw permits full control over the application, resulting in a loss of confidentiality, integrity, and availability. The weakness is identified as CWE‑269, reflecting an improper authorization or privilege escalation scenario.

Affected Systems

The affected product is Oracle JD Edwards EnterpriseOne General Ledger, version 9.2. Only this release is known to contain the vulnerability; no other versions are listed as impacted.

Risk and Exploitability

The CVSS base score of 9.9 indicates critical severity, with a low attack complexity but requiring local or network SMB access. The EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog. However, the scope change noted in the description means that successful exploitation could also impact additional Oracle products.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

JD Edwards EnterpriseOne General Ledger

affected

Version	Status	Constraints
`9.2`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:jd_edwards_enterpriseone_general_ledger:9.2:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Jd Edwards Enterpriseone General Ledger

Version	Status	Scheme	Platform
`9.2`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official patch or upgrade to a version of JD Edwards EnterpriseOne General Ledger that contains the fix referenced in Oracle's security alert.
Restrict or disable SMB access to the JD Edwards servers, limiting connectivity to trusted hosts and network segments only.
Implement monitoring of SMB traffic and audit logs for anomalous activity that could indicate exploitation attempts.

Generated by OpenCVE AI on June 18, 2026 at 12:48 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.301% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 4:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Low-Privilege Remote Takeover via SMB in JD Edwards EnterpriseOne General Ledger

Jun 17, 2026 1:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-269
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared		Oracle Oracle jd Edwards Enterpriseone General Ledger
CPEs		cpe:2.3:a:oracle:jd_edwards_enterpriseone_general_ledger:9.2:::::::*
Vendors & Products		Oracle Oracle jd Edwards Enterpriseone General Ledger
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`