A flaw in the JD Edwards EnterpriseOne Tools Interoperability SEC component allows an unauthenticated attacker who can reach the application over HTTPS to compromise the system. The vulnerability can be exploited remotely without prior authentication. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data, or total access to all data stored or managed by the tools. The impact is a breach of confidentiality and integrity for the affected repository or database, with no impact on availability reported in the description.

The vendors impacted are Oracle Corporation’s JD Edwards EnterpriseOne Tools. Affected builds range from version 9.2.0.0 through 9.2.26.5. Only this product line is enumerated; additional versions are not listed.

The CVSS v3.1 base score of 7.4 indicates high severity, with an attack complexity of high and no user interaction required. The vulnerability is accessed over HTTPS, allowing a remote attacker only network connectivity to the application. The EPSS score of < 1% indicates a low but non‑zero likelihood of exploitation. Because authentication is not required, the attack remains realistic. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploitation yet, but the high base score and direct network exposure warrant prompt mitigation.