The vulnerability lies in the Interoperability SEC component of Oracle JD Edwards EnterpriseOne Tools and permits an attacker with low privileges and network access via JDENET to take full control of the application. Successful exploitation can compromise the confidentiality, integrity, and availability of the system. The CVSS v3.1 base score of 8.8 indicates a high‑severity risk. The impact is a complete takeover of the Tools.

Oracle Corporation’s JD Edwards EnterpriseOne Tools product is affected. The vulnerability applies to supported versions 9.2.0.0 through 9.2.26.5. The affected component is Interoperability SEC, and the attack surface is the JDENET network interface.

With a CVSS base score of 8.8, the vulnerability is considered high‑severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, but the exploit is described as easily exploitable. The attack vector is network‑based, requiring only low privileges and no user interaction. Successful exploitation would allow an adversary to take over the Tools and potentially pivot to other parts of the JD Edwards environment.