This vulnerability affects Oracle JD Edwards EnterpriseOne Solution Advisor version 9.2. It is an easily exploitable network vulnerability requiring low attacker privileges and no user interaction. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly stated the availability of a patch or remediation level for this specific issue. The advisory strongly recommends applying security patches promptly to mitigate risks.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to fully compromise the JD Edwards EnterpriseOne Solution Advisor, resulting in complete loss of confidentiality, integrity, and availability of the affected system.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches addressing vulnerabilities across Oracle products, including JD Edwards EnterpriseOne Solution Advisor 9.2. However, the vendor advisory does not explicitly confirm the availability of a patch or remediation status for this specific vulnerability. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches without delay. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.