This vulnerability affects Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement version 9.2. It permits a low privileged attacker with network access via JDENET to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory lists this product and version among affected products but does not explicitly state patch availability or remediation details for this vulnerability.

Successful exploitation can result in complete compromise of JD Edwards EnterpriseOne Advanced Pricing - Procurement, impacting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via JDENET, but the attack complexity is high. There are no known exploits in the wild as of the advisory date.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others affecting JD Edwards EnterpriseOne Advanced Pricing - Procurement version 9.2. However, the advisory does not explicitly confirm the availability of a patch or official remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply security patches promptly when available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.