This vulnerability affects Oracle JD Edwards EnterpriseOne Order Promising component (version 9.2). It is an easily exploitable network vulnerability requiring low privileges and no user interaction, allowing an attacker to compromise the product fully, impacting confidentiality, integrity, and availability (CVSS 3.1 score 9.9). The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security patches for JD Edwards EnterpriseOne Order Promising 9.2 among other products. Oracle strongly recommends applying these patches immediately. Until patches are applied, risk can be partially mitigated by blocking required network protocols or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation can lead to complete takeover of JD Edwards EnterpriseOne Order Promising, affecting confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely over the network via HTTP by a low privileged attacker without user interaction. Due to scope change, other Oracle products may also be significantly impacted by attacks leveraging this vulnerability.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to fully remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Oracle strongly advises remaining on actively supported versions and promptly applying security patches.