PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46892 Oracle Corporation CVE debrief

CVE-2026-46892 is a critical vulnerability in JD Edwards EnterpriseOne Human Resources Management, with a CVSS score of 9.1. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data. Organizations should assess their exposure and prioritize patching to prevent potential data breaches. The vulnerability is located in the Human Resources component of JD Edwards EnterpriseOne Human Resources Management, version 9.2.

Vendor
Oracle Corporation
Product
JD Edwards EnterpriseOne Human Resources Management
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-26
Advisory published
2026-06-17
Advisory updated
2026-06-26

Who should care

Organizations using JD Edwards EnterpriseOne Human Resources Management version 9.2 should prioritize patching this vulnerability to prevent potential data breaches. This includes operators managing the affected system, platform administrators, vulnerability management teams, and security teams responsible for ensuring the confidentiality and integrity of HR data.

Technical summary

The vulnerability is located in the Human Resources component of JD Edwards EnterpriseOne Human Resources Management, version 9.2. It is easily exploitable by unauthenticated attackers with network access via HTTP. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all JD Edwards EnterpriseOne Human Resources Management accessible data, as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Human Resources Management accessible data. The CVSS 3.1 Base Score is 9.1, with Confidentiality and Integrity impacts.

Defensive priority

High priority should be given to patching this vulnerability due to its critical CVSS score and potential impact on data confidentiality and integrity.

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible.
  • Implement compensating controls, such as network segmentation or access controls, to limit the attack surface.
  • Monitor for suspicious activity and implement logging and auditing to detect potential exploitation attempts.
  • Verify that the system is not exposed to unnecessary risks by checking its network configuration and access controls.
  • Consider implementing additional security measures, such as intrusion detection and prevention systems.

Evidence notes

The CVE record was published on 2026-06-17T10:54:06.910Z and was last modified on 2026-06-26T03:44:25.337Z. The NVD entry is currently Analyzed. Evidence is limited to public CVE and NVD information. Defenders should verify system configurations, review network access controls, and assess potential exposure based on available information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46892 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46892

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46892 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46892

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.