CVE-2026-46893

Critical · CVSS 9.9

JD Edwards EnterpriseOne General Ledger — Improper Privilege Management (CWE-269) leading to full system takeover via SMB with scope change

CVSS: 9.9; nvd
EPSS: —
KEV: No
Class: other; CWE-269

Description

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols E1 FoundationJD Edwards EnterpriseOne General LedgerSMB9.2CWE-269CVE-2026-46893

Keywords CVE-2026-46893JD Edwards EnterpriseOne General LedgerE1 FoundationOracle JD Edwards privilege escalationJDE EnterpriseOne SMB RCEJDE 9.2 exploitOracle JD Edwards takeover PoCJD Edwards CWE-269

Versions: 9.2

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-26T06:00:38.000Z · profiled 2026-07-01T12:30:14.000Z