This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the product, resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. Although no explicit patch links were provided in the input, the advisory strongly recommends applying the Critical Security Patch Update to remediate this and other vulnerabilities. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, but these may disrupt application functionality.

The vulnerability allows unauthenticated remote attackers to fully compromise JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product, posing a critical risk to organizations using these versions.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory recommending application of the June 2026 Critical Security Patch Update.