NCSC-2026-0206 [1.00] [M/H] Vulnerabilities fixed in Oracle JD Edwards EnterpriseOne

unknownCVE-2026-46878 CVE-2026-46879 CVE-2026-46880 CVE-2026-46881 CVE-2026-46882 CVE-2026-46883

Oracle has fixed multiple vulnerabilities in Oracle JD Edwards EnterpriseOne, including the Tools, Accounts Payable, Human Resources Management, General Ledger, Order Promising, and Project Costing modules, specifically for versions 9.2.0.0 to 9.2.26.2. The vulnerabilities in Oracle JD Edwards EnterpriseOne allow an attacker to gain full control over the system without authentication or with low privileges via network access (HTTP or SMB). This includes creating, deleting, or modifying critical data, gaining unauthorized access to sensitive information, and causing a denial-of-service by crashing the system. The vulnerabilities affect the confidentiality, integrity, and availability of the system. Some vulnerabilities may also impact other related Oracle products due to the integrated nature of the suite.

CSIRTS triage

vendor: Oracle product: JD Edwards EnterpriseOne Remote code execution Authentication bypassOtheraffected: 9.2.0.0 to 9.2.26.2

What: Vulnerabilities could allow attackers to gain full control over the system without authentication.
Who is affected: Users of Oracle JD Edwards EnterpriseOne versions 9.2.0.0 to 9.2.26.2.
Urgency: Remediation is urgent due to the potential for complete system compromise.
Action: Users should apply the updates provided by Oracle.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch JD Edwards EnterpriseOne

Get an email when a new JD Edwards EnterpriseOne advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-06-17
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0206

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-468780.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468790.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468800.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468810.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468820.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468830.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468910.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468920.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-468930.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-469030.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-46878	coverage & exploitation status	NVD · CVE.org
CVE-2026-46879	coverage & exploitation status	NVD · CVE.org
CVE-2026-46880	coverage & exploitation status	NVD · CVE.org
CVE-2026-46881	coverage & exploitation status	NVD · CVE.org
CVE-2026-46882	coverage & exploitation status	NVD · CVE.org
CVE-2026-46883	coverage & exploitation status	NVD · CVE.org
CVE-2026-46891	coverage & exploitation status	NVD · CVE.org
CVE-2026-46892	coverage & exploitation status	NVD · CVE.org
CVE-2026-46893	coverage & exploitation status	NVD · CVE.org
CVE-2026-46903	coverage & exploitation status	NVD · CVE.org
CVE-2026-46904	coverage & exploitation status	NVD · CVE.org
CVE-2026-46905	coverage & exploitation status	NVD · CVE.org
CVE-2026-46906	coverage & exploitation status	NVD · CVE.org
CVE-2026-46907	coverage & exploitation status	NVD · CVE.org
CVE-2026-46908	coverage & exploitation status	NVD · CVE.org
CVE-2026-46909	coverage & exploitation status	NVD · CVE.org
CVE-2026-46910	coverage & exploitation status	NVD · CVE.org
CVE-2026-46911	coverage & exploitation status	NVD · CVE.org
CVE-2026-46912	coverage & exploitation status	NVD · CVE.org
CVE-2026-46913	coverage & exploitation status	NVD · CVE.org

Recent advisories for Oracle JD Edwards

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] Oracle JD Edwards: Multiple vulnerabilitiescert-bund · 2026-08-19
highCVE-2026-61273: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: I…nvd · 2026-08-18
criticalCVE-2026-61272: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: W…nvd · 2026-08-18
highCVE-2026-61270: Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (compo…nvd · 2026-08-18
highCVE-2026-61268: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: B…nvd · 2026-08-18
highCVE-2026-61265: Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (compo…nvd · 2026-08-18