A flaw in the Interoperability SEC component of JD Edwards EnterpriseOne Tools allows an attacker who can reach the SOAP interface to gain unauthorized, unauthenticated access to critical data. The weakness is rooted in missing authentication (CWE-306), enabling the attacker to read—or in some cases alter—any data the tool can access. Because the impacted component communicates with other JD Edwards products, a successful exploitation could expand the scope beyond the tool itself, potentially compromising additional system data.

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. These editions expose a SOAP endpoint that is reachable over the network, and the vulnerability resides in a shared interoperability layer that may influence other JD Edwards applications in the same environment.

The CVSS 3.1 score of 8.6 highlights a high‑severity risk driven primarily by confidentiality impact. The EPSS score of less than 1% suggests exploitation is unlikely but still possible. The vulnerability is not catalogued in CISA KEV. Attackers can exploit the flaw simply by sending unauthenticated SOAP requests over the network; no credentials or prior access are required, making the attack vector straightforward and imminently exploitable.