An unauthenticated attacker with network access via JDENET can compromise JD Edwards EnterpriseOne Tools, potentially taking full control of the system and accessing all data. The vulnerability allows the attacker to bypass authentication checks and gain full confidentiality, integrity, and availability impact, effectively allowing a total takeover of the application.

The affected product is Oracle JD Edwards EnterpriseOne Tools for the Enterprise Infrastructure Security component. Versions from 9.2.0.0 to 9.2.26.2 are vulnerable.

The CVSS 3.1 base score is 9.8, indicating very high severity. The EPSS score is less than 1 %, suggesting that exploitation is currently expected to be rare, and the vulnerability is not yet listed in CISA's KEV catalog. Nevertheless, the attack vector is remote over the network and requires no credentials, making it attractive to attackers who have network reach to the JDENET interface. Any successful exploitation would grant the attacker unrestricted access to the JD Edwards environment.