This vulnerability affects Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2. It is an easily exploitable flaw that permits a low privileged attacker with network access over HTTP to compromise the CRM Foundation component, potentially resulting in complete system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among those patched, confirming that a fix is available.

Successful exploitation of this vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise the JD Edwards EnterpriseOne CRM Foundation 9.2 system. This results in complete loss of confidentiality, integrity, and availability of the affected component, effectively enabling system takeover.

Oracle has released patches for JD Edwards EnterpriseOne CRM Foundation version 9.2 as part of the July 2026 Critical Patch Update. It is strongly recommended to apply these official patches promptly to remediate this vulnerability. No alternative mitigations or workarounds are specified in the advisory.