The flaw resides in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools. A low‑privileged attacker with network reach through the JDENET interface can trigger the vulnerability, which permits unauthorized updates, inserts, or deletions of accessible data, as well as read exposure of restricted data. The same attack can also cause the tool to hang or repeatedly crash, effectively denying availability to users.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected. The issue is confined to the Enterprise Infrastructure SEC component and is reachable via JDENET traffic.

The CVSS base score of 6.4 reflects moderate severity with impacts on confidentiality, integrity, and availability. The EPSS score is below 1%, indicating few publicly observed exploits at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only low‑privileged network access to JDENET, making the attack path straightforward, yet the potential for data tampering and denial of service remains significant.