This vulnerability affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 and allows an unauthenticated attacker with network access via JDENET to compromise the product. The CVSS 3.1 score of 9.8 reflects critical impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability among 245 others. Oracle advises customers to apply these patches without delay to prevent exploitation. Mitigation options prior to patching include blocking network protocols used by the attack and limiting user privileges, though these may disrupt normal operations.

The vulnerability enables an unauthenticated remote attacker to take over JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access, data compromise, and disruption of services.

Oracle has released a Critical Security Patch Update that includes fixes for this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and removing unnecessary privileges from users, but these measures may affect application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.