This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the system, potentially leading to full takeover of JD Edwards EnterpriseOne Tools. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which contains 245 security patches across multiple Oracle products. Oracle strongly recommends applying these patches promptly. No specific patch version or remediation level is explicitly stated for this vulnerability in the advisory. Workarounds include blocking network protocols used by the attack or removing unnecessary privileges, but these may disrupt normal operations.

Successful exploitation allows an unauthenticated remote attacker to fully compromise JD Edwards EnterpriseOne Tools, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to total takeover of the product, potentially impacting business-critical operations that rely on JD Edwards EnterpriseOne Tools.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or access to vulnerable components. However, these mitigations may disrupt normal application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle Critical Security Patch Update documentation for the latest remediation guidance.