The flaw resides in the E1 Foundation component of JD Edwards EnterpriseOne General Ledger. The vulnerability allows a low‑privileged attacker who has network access via JDENET to induce a hang or a repeatable crash, effectively causing a complete denial of service for the General Ledger application. According to the CVSS vector it affects availability only and requires network access while the attacker’s privileges are limited. The reported CVSS base score is 5.3, indicating moderate severity.

Only Oracle JD Edwards EnterpriseOne General Ledger version 9.2 is affected. The vulnerability is specific to that release and not reported for earlier or later versions.

The vulnerability can be triggered over the JDENET network interface, so any user with access to that interface in a compromised environment can attempt exploitation. The AV:N/AC:H/PR:L/UI:N/S:U vector implies that a remote attacker does not need to authenticate or interact via a user interface, but must possess low privileges. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalogue. Overall, the risk is moderate but could become higher if the JDENET exposure expands or the vulnerability is leveraged in conjunction with other weaknesses.