CVE Explorer
CVE-2026-46893
Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
cwe · 2 assertions
{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger.","lang":"en-US"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/cna/problemTypes/0/descriptions/0
Affected products and versions
1 source assertion{"product":"JD Edwards EnterpriseOne General Ledger","vendor":"Oracle Corporation","versions":[{"status":"affected","version":"9.2","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
2 source assertions{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger.","lang":"en-US"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"Oracle Advisory","tags":["vendor-advisory"],"url":"https://www.oracle.com/security-alerts/cspujun2026.html"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9751e20fdc32af840b767cd96d6c7c20ff1ff518663660ed8ca689dccefedcce · sha256:f4c2fb8c9d8d3362… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.