This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It is easily exploitable remotely without authentication via the JDENET protocol, allowing an attacker to take over the affected software. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but can affect application functionality.

Successful exploitation results in complete takeover of JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the system. This can lead to unauthorized access, data compromise, and disruption of services. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread attacks if unpatched.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to fully remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by JDENET or by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Oracle strongly advises remaining on actively supported versions and promptly applying security updates.