This vulnerability affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2, specifically the Web Runtime Security component. It is an easily exploitable remote vulnerability requiring no authentication and allows an attacker with network access over HTTP to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network attack vector with low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for JD Edwards EnterpriseOne Tools. The vendor strongly urges customers to apply these patches immediately to prevent exploitation. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk but could disrupt application functionality.

Successful exploitation allows an unauthenticated remote attacker to take over JD Edwards EnterpriseOne Tools, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is confirmed by the vendor advisory. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.