This vulnerability affects Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2 and allows unauthenticated remote attackers to gain unauthorized access and modify critical data via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be exploited over the network with low complexity. Oracle has acknowledged this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes patches for this and many other vulnerabilities across multiple Oracle products. The advisory strongly recommends applying the security patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within JD Edwards EnterpriseOne Human Resources Management. This compromises confidentiality and integrity of the data but does not affect system availability. The vulnerability can be exploited remotely without authentication, increasing the risk of widespread impact if unpatched.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by removing unnecessary privileges from users, although these measures may impact application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.