A vulnerability exists in the JD Edwards EnterpriseOne Tools that enables an attacker with low privileges and basic network access via JDENET to compromise the application. The flaw leads to full takeover, exposing all data and allowing the attacker to alter or delete information. The CVSS vector indicates a high impact on confidentiality, integrity, and availability, with no requirement for user interaction.

Oracle JD Edwards EnterpriseOne Tools versions from 9.2.0.0 through 9.2.26.5 suffer from this weakness. The affected component is the Database and Communication Security module.

The CVSS base score of 8.8 classifies this as a high‑severity issue. With a low complexity attack and low privilege requirement, the exploitation risk is significant, especially for organizations that allow broad network reach to JDENET. Although EPSS data is not yet available, the lack of a KEV listing does not diminish the urgency; the attack vector is readily usable over standard network connections, making the threat real.