This vulnerability affects Oracle JD Edwards EnterpriseOne General Ledger version 9.2 and is exploitable by a low privileged attacker with network access via SMB. Successful exploitation can lead to complete compromise of the General Ledger component, with high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting other Oracle products. Oracle has addressed this issue in its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory emphasizes the importance of applying these patches promptly and suggests temporary mitigations such as blocking network protocols or restricting privileges until patches are applied.

Successful exploitation allows an attacker with low privileges and network access via SMB to take over the JD Edwards EnterpriseOne General Ledger component. This results in complete compromise affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means additional Oracle products may also be impacted indirectly. No known exploits in the wild have been reported yet.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (such as SMB) and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle recommends remaining on actively supported versions and applying security patches promptly.