PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46911 Oracle Corporation CVE debrief

A critical vulnerability was discovered in JD Edwards EnterpriseOne Project Costing, a product of Oracle JD Edwards. The vulnerability, tracked as CVE-2026-46911, has a CVSS score of 9.6 and can be easily exploited by a low-privileged attacker with network access via JDENET. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all JD Edwards EnterpriseOne Project Costing accessible data, as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Project Costing accessible data. Organizations using JD Edwards EnterpriseOne Project Costing version 9.2 should prioritize patching this vulnerability to prevent potential attacks.

Vendor
Oracle Corporation
Product
JD Edwards EnterpriseOne Project Costing
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-18
Advisory published
2026-06-17
Advisory updated
2026-06-18

Who should care

Organizations using JD Edwards EnterpriseOne Project Costing version 9.2 should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's high CVSS score and ease of exploitation make it a critical concern for security teams, particularly those responsible for vulnerability management and incident response.

Technical summary

The vulnerability, tracked as CVE-2026-46911, is located in the Job Costing component of JD Edwards EnterpriseOne Project Costing. It has a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating a high impact on confidentiality and integrity. The supported version affected is 9.2. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all JD Edwards EnterpriseOne Project Costing accessible data, as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Project Costing accessible data.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided by Oracle Corporation as soon as possible.
  • Restrict network access to JD Edwards EnterpriseOne Project Costing to only necessary personnel.
  • Monitor JD Edwards EnterpriseOne Project Costing logs for suspicious activity.
  • Consider implementing additional security controls, such as multi-factor authentication.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-06-17T10:54:08.920Z and was last modified on 2026-06-18T22:07:57.640Z. The NVD entry is currently Analyzed. The vulnerability is in JD Edwards EnterpriseOne Project Costing, specifically in the Job Costing component. The supported version that is affected is 9.2. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46911 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46911

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46911 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46911

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.