This vulnerability exists in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools. It allows an attacker who has network connectivity to the HTTP port to gain unauthorized access to critical data without authentication or elevated privileges. The weakness is an improper access control flaw, which can let the attacker read or obtain all data exposed through the tools interface.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are impacted. Users running any of these releases should verify whether they are within the affected range.

The CVSS v3.1 score of 5.9 indicates moderate severity, with confidentiality being the only impacted sub‑score. Exploitation requires only network access to HTTP and does not need authentication, rendering the attack path straightforward for anyone with network reach. The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at this time, yet the potential for unauthorized data access warrants timely remediation.