Technical impact
The flaw exists in the Enterprise Infrastructure Security component of Oracle’s JD Edwards EnterpriseOne Tools and allows an unauthenticated, network-based attacker to execute arbitrary code with application privileges. Successful exploitation leads to full takeover of the tools, severely impacting confidentiality, integrity, and availability of the entire application.
Affected Systems
Versions of JD Edwards EnterpriseOne Tools ranging from 9.2.0.0 to 9.2.26.2 are vulnerable. The JDENET service component, reachable over the network, is the attack surface. Any deployment in this version range exposed to JDENET traffic is at risk unless a patch or later release is installed.
Risk and Exploitability
The CVSS score highlights high impact on all security properties. While the EPSS score is below 1 %, indicating currently low exploitation probability, the CVE is still readily exploitable without authentication and over a network interface. The flaw is not listed in CISA’s KEV catalog, yet it presents a serious risk for systems that expose JDENET to untrusted networks. An attacker can trigger the vulnerability by sending crafted JDENET traffic from any remote host, leveraging the lack of authentication and low attack complexity.
