This vulnerability affects Oracle JD Edwards EnterpriseOne General Ledger version 9.2 (component: E1 Foundation). It allows an unauthenticated attacker with network access via HTTP to cause a hang or repeated crash (denial of service) and gain unauthorized ability to update, insert, delete, or read some accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update advisory lists JD Edwards EnterpriseOne 9.2 among affected products with available patches, indicating that remediation is provided through this update. No public exploits are known at this time.

Successful exploitation can result in denial of service by causing the JD Edwards EnterpriseOne General Ledger to hang or crash repeatedly. Additionally, attackers can gain unauthorized read access to some data and unauthorized update, insert, or delete capabilities on accessible data within the General Ledger component. The impact affects confidentiality, integrity, and availability, but confidentiality and integrity impacts are limited (low), while availability impact is high.

Oracle has included JD Edwards EnterpriseOne General Ledger version 9.2 in its July 2026 Critical Patch Update, which provides security patches addressing this vulnerability. Customers should apply the patches from this update promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory indicating patch availability in the July 2026 CPU. No additional mitigation steps are specified by Oracle.