This vulnerability affects Oracle JD Edwards EnterpriseOne Configurator 9.2 and involves configuration management components. It can be exploited remotely by an attacker with low privileges over HTTP, requiring high attack complexity. Successful exploitation can lead to unauthorized ability to cause a hang or repeated crash (complete denial of service) and unauthorized read, update, insert, or delete access to some data accessible by the Configurator. The CVSS vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, reflecting network attack vector, high complexity, low privileges, no user interaction, unchanged scope, low confidentiality and integrity impact, and high availability impact. The vulnerability is documented in Oracle's July 2026 Critical Patch Update advisory, but no specific patch or remediation details are provided in the advisory content.

An attacker with network access and low privileges can exploit this vulnerability to cause a denial of service by hanging or crashing the JD Edwards EnterpriseOne Configurator. Additionally, the attacker can gain unauthorized read access to some data and unauthorized update, insert, or delete access to some accessible data within the Configurator. The confidentiality and integrity impacts are low, but the availability impact is high.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches for affected products including JD Edwards EnterpriseOne Configurator 9.2. Customers are strongly advised to review the advisory and apply the relevant patches promptly. Since no explicit patch or temporary fix details are provided in the advisory content, users should monitor Oracle's official security alerts and apply updates as soon as they become available. No vendor statement indicates that no action is required or that the issue is already mitigated.