A flaw in the Business Logic Infra SEC component of Oracle JD Edwards EnterpriseOne Tools allows a low‑privileged attacker who can reach the system over JDENET to gain unauthorized update, insert, delete or read access to application data. The vulnerability is exploitable with a simple network connection and does not require administrative credentials, enabling alterations that compromise data integrity and confidentiality. It is scored a CVSS 3.1 Base Score of 5.4, indicating moderate impact on confidentiality and integrity but no effect on availability.

Oracle JD Edwards EnterpriseOne Tools, specifically the Business Logic Infra SEC component, is affected in supported releases 9.2.0.0 through 9.2.26.5. Users of any version within this range must verify whether their installation includes these components.

The CVSS rating of 5.4 reflects a moderate severity, and the absence of an EPSS score suggests limited public exploit data at present. However, because the attack vector is network‑based and requires only low privilege, local network compromise or unsafe JDENET exposure could be sufficient to exploit the flaw. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation, but its accessibility and impact merit attention. A conservative assessment recommends treating this as a moderate risk that could enable data tampering or leakage if mitigated.