The vulnerability resides in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools and permits a low‑privileged attacker with network access via JDENET to compromise the tool. When successfully exploited the attacker achieves full takeover of the system, resulting in complete loss of confidentiality, integrity and availability as reflected by the CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Oracle Corporation’s JD Edwards EnterpriseOne Tools are affected, specifically versions 9.2.0.0 through 9.2.26.5. The exploitation path requires the hijacker to connect over the JDENET network interface, which the product exposes for remote communication.

The CVSS v3.1 Base Score of 7.5 indicates a high impact rating, with the vulnerability being exploitable remotely (AV:N) but requiring high effort (AC:H). The privileged requirement is low (PR:L) and no user interaction is needed (UI:N). No EPSS score is available, but the severity and lack of official KEV listing suggest that exploitation is plausible yet not currently widespread. The attacker’s ability to perform a full takeover places a high risk on organizations that rely on JDENET for critical business operations.