CVE-2026-46891: JD Edwards EnterpriseOne Auth Bypass

CVE-2026-46891 Overview

CVE-2026-46891 is a high-severity access control vulnerability [CWE-284] in the Oracle JD Edwards EnterpriseOne Accounts Payable product. The flaw affects supported version 9.2 of the Accounts Payable component. A low-privileged attacker with network access over HTTP can exploit the issue to compromise the application. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all data accessible by the Accounts Payable module. Oracle published the advisory as part of its security alerts program.

Critical Impact
Authenticated attackers with low privileges can remotely read, modify, or delete all data accessible through JD Edwards EnterpriseOne Accounts Payable over HTTP, threatening financial integrity and confidentiality.

Affected Products

Oracle JD Edwards EnterpriseOne Accounts Payable
Component: Accounts Payable
Supported version affected: 9.2

Discovery Timeline

2026-06-17 - CVE-2026-46891 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-46891

Vulnerability Analysis

The vulnerability resides in the Accounts Payable component of Oracle JD Edwards EnterpriseOne 9.2. It is classified under [CWE-284] Improper Access Control. An attacker authenticated with low privileges can issue HTTP requests that bypass intended access control boundaries within the Accounts Payable module. Once exploited, the attacker reads, modifies, creates, or deletes data accessible to the module. Oracle rates confidentiality and integrity impacts as high, while availability is unaffected. Because Accounts Payable handles vendor records, invoices, and disbursement data, exploitation directly threatens financial reporting accuracy and supplier payment integrity.

Root Cause

The root cause is improper access control enforcement in the Accounts Payable application logic. The component does not adequately validate whether an authenticated session is authorized to perform the requested data operation. Authorization checks appear to rely on assumptions that a low-privileged session cannot reach sensitive endpoints or operations. Oracle has not published exploit-level technical detail in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires a low-privileged authenticated account but no user interaction. Attack complexity is low and the scope is unchanged. Exploitation involves sending crafted HTTP requests to Accounts Payable endpoints to perform data operations outside the attacker's authorized scope. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.326%.

No verified exploitation code is publicly available. Refer to the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-46891

Indicators of Compromise

Unexpected create, update, or delete operations in Accounts Payable tables originating from low-privileged accounts.
HTTP requests to JD Edwards EnterpriseOne endpoints that do not align with the user's documented role assignments.
Anomalous access to vendor master records, payment batches, or invoice tables outside normal business hours.

Detection Strategies

Audit JD Edwards security workbench logs for role-action mismatches against the Accounts Payable application.
Correlate web server access logs with application-level authorization decisions to identify requests that succeed despite low privilege context.
Baseline normal Accounts Payable transaction volume per user and alert on deviations exceeding established thresholds.

Monitoring Recommendations

Forward JD Edwards EnterpriseOne HTTP server, application server, and database audit logs to a centralized SIEM for correlation.
Monitor changes to supplier bank account details, payment terms, and invoice approval status as high-priority alerts.
Track authentication events and session reuse patterns for accounts with Accounts Payable access.

How to Mitigate CVE-2026-46891

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for June 2026.
Inventory all JD Edwards EnterpriseOne 9.2 deployments and confirm patch status across production and non-production environments.
Review and reduce the population of accounts with any Accounts Payable role assignments to the minimum required.

Patch Information

Oracle has released a security patch addressed in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert and apply the fix for JD Edwards EnterpriseOne version 9.2 according to Oracle's documented patch installation procedure.

Workarounds

Restrict HTTP access to JD Edwards EnterpriseOne Accounts Payable endpoints using network segmentation and reverse proxy allow-lists until the patch is applied.
Enforce stricter role-based access control inside JD Edwards Security Workbench, removing inherited permissions not required for business function.
Increase audit logging verbosity on the Accounts Payable application and require multi-factor authentication for all interactive sessions.

bash

# Example: restrict HTTP access to JD Edwards Accounts Payable endpoints at the reverse proxy
# (adjust to your environment - this is illustrative)
location /jde/AccountsPayable/ {
    allow 10.10.20.0/24;   # Finance VLAN
    deny  all;
    proxy_pass http://jde-backend;
}