The vulnerability resides in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools, where an unauthenticated attacker who can reach the service over HTTP can exploit a flaw to execute arbitrary code. The flaw results in a full compromise of the JD Edwards EnterpriseOne Tools application, leading to loss of confidentiality, integrity, and availability of the underlying business data.

This flaw affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2. Any deployment of these product releases is at risk, regardless of the operating system or database platform, because the vulnerability exists in the web runtime layer of the tools.

The CVSS 3.1 base score of 9.8 indicates critical severity, and the available EPSS score of <1% suggests that, so far, exploitation attempts have been rare. The flaw can be exploited from any networked host without prior authentication, making it easily reachable by attackers with HTTP access to the JD Edwards instance. Although the vulnerability has not yet been listed in the CISA KEV catalog, its impact warrants immediate attention.