A vulnerability exists in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools. The weakness permits a low‑privileged attacker who can reach the JDENET interface to gain unauthorized update, insert or delete capability over data accessible through the tools. The same flaw also allows the attacker to read a subset of that data. In addition, successful exploitation can lead to a hang or repeated crash of the JD Edwards EnterpriseOne Tools service, effectively causing a denial of service. The vulnerability encompasses Confidentiality, Integrity and Availability impacts as reflected by the CVSS 3.1 vector.

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. The flaw exists in the Enterprise Infrastructure SEC component exposed via JDENET. No other vendors or products are listed as impacted.

The CVSS score is 6.4, indicating a moderate severity. The EPSS score is < 1%, so exploitation likelihood cannot be quantified from published data. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires network access to JDENET and a low‑privilege account; therefore prior authentication and network reachability are prerequisites. Once the vulnerability is triggered, an attacker can cause service crashes and read or alter data without high privilege, potentially impacting business continuity and data integrity.