This vulnerability affects Oracle JD Edwards EnterpriseOne Orchestrator (component: E1 IOT Orchestrator Security) in versions 9.2.0.0 through 9.2.26.4. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through the Orchestrator. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has published a Critical Security Patch Update in August 2026 addressing this and other vulnerabilities.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within JD Edwards EnterpriseOne Orchestrator. This includes the ability to create, delete, or modify data, potentially compromising the confidentiality and integrity of all data accessible through the Orchestrator. There is no reported impact on availability. No known exploits in the wild have been reported as of the publication date.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 are strongly advised to apply the relevant patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.