The vulnerability in Oracle JD Edwards EnterpriseOne Tools, located in the Enterprise Infrastructure Security component, allows an attacker with network access via the JDENET protocol to compromise the system without authentication. Exploitation of this flaw leads to total takeover of the tools, resulting in full compromise of confidentiality, integrity, and availability. The flaw permits execution of arbitrary code on the target system, effectively providing remote code execution capabilities to a remote attacker.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.2, are affected. These versions are part of the JD Edwards EnterpriseOne suite provided by Oracle Corporation.

A CVSS v3.1 base score of 9.8 classifies this vulnerability as critical, indicating a high likelihood of successful exploitation. The EPSS score of less than 1% suggests that, at present, the probability of exploitation in the wild is low, and the vulnerability is not currently listed in the CISA KEV catalog. The attack can be carried out remotely over the network using JDENET, requires no authentication or user interaction, and can be executed from any host that can reach the JDENET port. Consequently, environments running the affected versions of JD Edwards EnterpriseOne Tools face a significant risk if they remain exposed to potential unauthenticated traffic.