This vulnerability affects Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2. It is easily exploitable by an attacker with low privileges and network access over HTTP. The vulnerability can result in complete compromise of the CRM Foundation component. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle indicates this issue is addressed in their July 2026 Critical Patch Update, which includes patches for JD Edwards EnterpriseOne CRM Foundation 9.2.

Exploitation of this vulnerability can lead to full takeover of the JD Edwards EnterpriseOne CRM Foundation system, resulting in complete loss of confidentiality, integrity, and availability of the affected component. This could allow attackers to access sensitive data, modify or delete information, and disrupt service operations.

Oracle has released security patches for JD Edwards EnterpriseOne CRM Foundation version 9.2 as part of the July 2026 Critical Patch Update. It is strongly recommended to apply these patches promptly to remediate the vulnerability. Customers should refer to the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. No alternative mitigations are specified by the vendor.