The JD Edwards EnterpriseOne Tools product is vulnerable through its Web Runtime SEC component, allowing an unauthenticated attacker with HTTP network access to execute a browser‑based exploit that enables unauthorized read, insert, update, or delete of data. The flaw, classified as CWE‑79, compromises the confidentiality and integrity of the system, and because it requires the attacker to trick a non‑attacker user into interacting with malicious content, the attack is not immediate but can have significant consequences once triggered.

The vulnerability affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.0. Oracle issued an advisory for these releases, and the listed component is the Web Runtime SEC.

With a CVSS 3.1 base score of 6.1 and an EPSS below 1 percent, the flaw represents a moderate‑severity risk with a very low likelihood of exploitation in the wild. It is not yet catalogued in the CISA KEV list. The attack vector is network‑based over HTTP, and the attacker requires the cooperation of a legitimate user to complete the exploit; however, the flaw can also affect other products, potentially extending its scope beyond the initially targeted instance.