This vulnerability affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 and allows an unauthenticated attacker with network access via the JDENET protocol to compromise the product. The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches across multiple products. The advisory strongly recommends applying these patches without delay. Workarounds include blocking network protocols used by the attack or removing unnecessary privileges, but these may disrupt normal operations.

An unauthenticated attacker with network access can exploit this vulnerability to take over JD Edwards EnterpriseOne Tools, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data manipulation, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches addressing this vulnerability. Customers should apply these patches as soon as possible. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (e.g., JDENET) and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches promptly.