This vulnerability affects Oracle JD Edwards EnterpriseOne HCM Foundation component OW HR PR Foundation, specifically version 9.2. An attacker with low privileges and network access via HTTP can exploit this flaw to cause the application to hang or crash repeatedly, resulting in a complete denial of service. Additionally, the attacker can gain unauthorized read access to a subset of data accessible by the application. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and high availability impact. There is no explicit vendor advisory stating a patch or fix is available yet, but the vulnerability is included in Oracle's July 2026 Critical Patch Update advisory listing affected products and versions. The advisory recommends applying patches promptly but does not specify a direct patch for this vulnerability at this time.

Successful exploitation can lead to unauthorized partial data disclosure (read access to some data) and a complete denial of service by causing the JD Edwards EnterpriseOne HCM Foundation to hang or crash repeatedly. This impacts confidentiality and availability of the affected system. The attacker requires network access and low privileges but no user interaction.

Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among affected products but does not explicitly confirm availability of a specific patch for JD Edwards EnterpriseOne HCM Foundation 9.2. Customers are strongly advised to monitor Oracle's advisory page for patch releases and apply security patches promptly once available. Until a patch is confirmed, consider restricting network access to the affected service to trusted users only and monitor for unusual application behavior. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html