This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the system, potentially resulting in full takeover of JD Edwards EnterpriseOne Tools. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update. The vendor advisory strongly urges customers to apply the patches without delay and notes that blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt functionality.

Successful exploitation allows unauthenticated remote attackers to fully compromise JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the affected system. This can lead to complete takeover of the product, potentially allowing attackers to execute arbitrary actions within the environment.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status is confirmed by the vendor advisory; no alternative fixes are noted.