This vulnerability affects Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. It is an easily exploitable remote vulnerability that requires no authentication and can be triggered over HTTP. Exploitation results in high impact on confidentiality and integrity, allowing attackers to create, delete, or modify critical data or gain complete unauthorized access to all data accessible by the product. The vulnerability is addressed in Oracle's June 2026 Critical Security Patch Update. Oracle advises customers to apply the patches immediately and provides guidance on potential temporary mitigations such as network protocol blocking and privilege restrictions, acknowledging possible functional impacts.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data or all accessible data in JD Edwards EnterpriseOne Human Resources Management. This results in a high confidentiality and integrity impact. There is no impact on availability reported. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1.

Oracle has released a Critical Security Patch Update in June 2026 that includes patches addressing this vulnerability. Customers are strongly advised to apply these security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt application functionality. Oracle’s advisory should be consulted for detailed patch availability and installation instructions: https://www.oracle.com/security-alerts/cspujun2026.html