This vulnerability affects Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. It allows a low privileged attacker with network access via JDENET to compromise the Human Resources Management component, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory lists this product and version among those addressed, but does not explicitly confirm patch availability or remediation level for this specific issue.

Successful exploitation can lead to complete compromise of the JD Edwards EnterpriseOne Human Resources Management component, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially leading to unauthorized access and control over sensitive HR data and functionality.

Oracle's July 2026 Critical Patch Update advisory includes JD Edwards EnterpriseOne Human Resources Management version 9.2 among the affected products addressed in this update. Customers are strongly advised to apply the July 2026 Critical Patch Update promptly to remediate this and other vulnerabilities. Since no explicit patch status or temporary mitigations are provided for this specific vulnerability, applying the official Oracle patches is the recommended course of action. Monitor Oracle's advisory page for any updates or additional remediation instructions.