This vulnerability exists in the JD Edwards EnterpriseOne General Ledger 9.2 product and is caused by a data exposure weakness flagged as CWE‑200. An attacker who can send traffic through the JDENET network interface and who has low privileges can trigger repeated crashes or hangs that result in a complete denial of service. The flaw does not provide any additional information that could be used for data exfiltration; its effect is purely on application availability.

Oracle Corporation’s JD Edwards EnterpriseOne General Ledger version 9.2 is the only product version documented as affected. No earlier or later releases are currently reported to contain this issue.

Exploitation requires only network connectivity to the JDENET interface and no user authentication. The base CVSS score of 5.3 indicates moderate severity for availability impact, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the current environment. With the vulnerability not listed in CISA’s KEV catalog, the overall risk is moderate but could increase if JDENET is exposed broadly or used in combination with other weaknesses.