This vulnerability affects Oracle JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.2. It is an easily exploitable network vulnerability requiring only low privileges and no user interaction, accessible via HTTP. The vulnerability allows attackers to gain unauthorized capabilities to create, delete, or modify critical data within JD Edwards EnterpriseOne Tools, with a scope that may extend to other related Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects high confidentiality and integrity impacts without affecting availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported at this time.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within JD Edwards EnterpriseOne Tools, compromising confidentiality and integrity of sensitive information. The scope of impact may extend beyond the Tools product to other related Oracle products. The vulnerability does not affect availability but poses a critical risk due to the potential for significant data compromise.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users to limit attack surface. Customers should remain on actively supported versions and apply security patches without delay. Patch status is confirmed by Oracle’s advisory; a fix is available in the June 2026 Critical Security Patch Update.