This vulnerability exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3. It is easily exploitable by an attacker with low privileges who can access the network via HTTP. Successful exploitation can lead to complete compromise of the EnterpriseOne Tools component, with a scope change potentially impacting other Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this version.

The vulnerability allows an attacker with low privileges and network access to fully compromise JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability of the affected system. The scope change indicates that additional Oracle products may be affected indirectly. The critical CVSS score of 9.9 reflects the severe potential impact of this vulnerability.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its list of addressed issues. However, explicit patch availability for version 9.2.26.3 is not confirmed in the advisory content provided. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is confirmed and applied, restrict network access to JD Edwards EnterpriseOne Tools and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.