The vulnerability within Oracle's JD Edwards EnterpriseOne Tools enables an unauthenticated attacker with network access to the JDENET interface to compromise the system. Successful exploitation can yield unauthorized read access to critical data or full control over all data exposed by the tools, directly impacting confidentiality. The weakness originates from improper authorization, allowing data disclosure without requiring authentication to the application.

Affected Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) includes versions 9.2.0.0 through 9.2.26.5. The product is supplied by Oracle Corporation.

The CVSS 3.1 base score of 5.9 reflects moderate severity with a confidentiality focus, and the unavailable EPSS score plus absence from the CISA KEV catalog suggest limited public exploitation at this time. Nevertheless, the flaw demands only network connectivity to JDENET and no prior authentication, making it a viable avenue for attackers with reach to the environment. The potential for data exposure remains significant for systems exposed to untrusted networks.