The vulnerability resides in the Interoperability SEC component of Oracle JD Edwards EnterpriseOne Tools and allows an unauthenticated attacker with network access over TLS to compromise the application. Successful exploitation can result in the unauthorized creation, deletion or modification of critical data, and in some cases complete access to all data exposed through JD Edwards EnterpriseOne Tools. The weakness reflects an improper access control that leads to Confidentiality and Integrity impacts, as summarized by the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are impacted. The affected product is JD Edwards EnterpriseOne Tools produced by Oracle Corporation, specifically the Interoperability SEC component.

The CVSS 3.1 base score of 7.4 indicates high severity, highlighting significant confidentiality and integrity risks. The EPSS score of 0.00318 (< 1%) indicates a very low probability of exploitation. The lack of authentication combined with network accessibility over TLS implies a wide attack surface. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploitation yet, but its difficulty level is described as difficult, meaning readiness to explore is non‑trivial. Nonetheless, the high impact and potential for accidental exposure warrant immediate defensive action.