This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via the JDENET protocol to compromise the system, resulting in full takeover of JD Edwards EnterpriseOne Tools. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 other security fixes. Oracle strongly advises customers to apply the update immediately to prevent exploitation.

The vulnerability enables unauthenticated remote attackers to gain full control over JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and service disruption. The CVSS score of 9.8 reflects the critical severity and potential for complete system compromise.

Oracle has released security patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required by the attack (JDENET) and removing unnecessary privileges or access to relevant packages for users. However, these mitigations may affect application functionality. Oracle recommends remaining on actively supported versions and promptly applying all security updates as the primary defense.