This vulnerability affects Oracle JD Edwards EnterpriseOne US Payroll version 9.2. It permits a low privileged attacker with network access through JDENET to compromise the US Payroll component. The vulnerability is rated with a CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Successful exploitation can result in takeover of the US Payroll system. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides targeted security fixes for this and many other vulnerabilities.

Successful exploitation of this vulnerability can lead to complete compromise of the JD Edwards EnterpriseOne US Payroll system, affecting confidentiality, integrity, and availability of the payroll data and operations. This could allow an attacker to take over the payroll component, potentially leading to unauthorized access and manipulation of sensitive payroll information.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.