This vulnerability affects Oracle JD Edwards EnterpriseOne Tools component Enterprise Infrastructure Security in versions 9.2.0.0 through 9.2.26.2. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data or causing a hang or repeatable crash leading to denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and high availability impact. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches without delay. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to unauthorized access to all data accessible by JD Edwards EnterpriseOne Tools and can cause a complete denial of service by hanging or crashing the application. This impacts confidentiality and availability of the affected system. There is no indication of integrity impact. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by restricting privileges and access to relevant packages for users who do not require them, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.