This vulnerability affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 and allows an unauthenticated attacker with network access via the JDENET protocol to compromise the product completely. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in full confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. Oracle strongly advises customers to apply these patches immediately to mitigate the risk. Workarounds include blocking network protocols used by the attack and restricting privileges, though these may disrupt normal operations.

The vulnerability allows unauthenticated remote attackers to fully compromise JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system, potentially allowing attackers to execute arbitrary code, access sensitive data, and disrupt services.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is confirmed by Oracle's advisory at https://www.oracle.com/security-alerts/cspujun2026.html.