The flaw exists in the Enterprise Infrastructure Security component of Oracle’s JD Edwards EnterpriseOne Tools and enables an unauthenticated network attacker to execute arbitrary code with application privileges. Successful exploitation results in complete takeover of the tools, affecting confidentiality, integrity, and availability of the entire application. The vulnerability carries a CVSS 3.1 base score of 9.8.

Versions of JD Edwards EnterpriseOne Tools ranging from 9.2.0.0 to 9.2.26.2 are vulnerable. The JDENET service component, reachable over the network, is the attack surface. Any deployment in this version range exposed to JDENET traffic is at risk unless a patch or later release is installed.

The CVSS score highlights high impact on all security properties. While the EPSS score is below 1 %, indicating currently low exploitation probability, the CVE is still readily exploitable without authentication and over a network interface. The flaw is not listed in CISA’s KEV catalog, yet it presents a serious risk for systems that expose JDENET to untrusted networks. An attacker can trigger the vulnerability by sending crafted JDENET traffic from any remote host, leveraging the lack of authentication and low attack complexity.