PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46911 Oracle Corporation CVE debrief

A critical vulnerability was discovered in JD Edwards EnterpriseOne Project Costing, a product of Oracle JD Edwards. The vulnerability, tracked as CVE-2026-46911, has a CVSS score of 9.6 and can be easily exploited by a low-privileged attacker with network access via JDENET. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all JD Edwards EnterpriseOne Project Costing accessible data, as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Project Costing accessible data. Organizations using JD Edwards EnterpriseOne Project Costing version 9.2 should prioritize patching this vulnerability to prevent potential attacks.

Vendor
Oracle Corporation
Product
JD Edwards EnterpriseOne Project Costing
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using JD Edwards EnterpriseOne Project Costing version 9.2 should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's high CVSS score and ease of exploitation make it a critical concern for security teams, particularly those responsible for vulnerability management and incident response.

Technical summary

The vulnerability, tracked as CVE-2026-46911, is located in the Job Costing component of JD Edwards EnterpriseOne Project Costing. It has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating a high impact on confidentiality and integrity. The supported version affected is 9.2. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all JD Edwards EnterpriseOne Project Costing accessible data, as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Project Costing accessible data.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible.
  • Restrict network access to JD Edwards EnterpriseOne Project Costing to only necessary personnel.
  • Monitor JD Edwards EnterpriseOne Project Costing logs for suspicious activity.
  • Consider implementing additional security controls, such as multi-factor authentication.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-06-17T10:54:08.920Z and was last modified on 2026-06-18T22:07:57.640Z. The NVD entry is currently Analyzed. The vulnerability is in JD Edwards EnterpriseOne Project Costing, specifically in the Job Costing component. The supported version that is affected is 9.2. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-17T10:54:08.920Z and has not been modified since then. The NVD entry is currently Analyzed.