This vulnerability affects Oracle JD Edwards EnterpriseOne Requirements Planning version 9.2. It permits a low privileged attacker with network access through JDENET to compromise the Requirements Planning component, potentially leading to full takeover. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can result in complete takeover of the JD Edwards EnterpriseOne Requirements Planning component, impacting confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but is difficult to exploit due to high attack complexity.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly confirm patch availability or remediation for it. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Until a specific patch is confirmed, monitor Oracle advisories for updates. No vendor-stated 'no action required' or 'already mitigated' status is indicated.