The vulnerability is in the Portal SEC component of Oracle’s JD Edwards EnterpriseOne Tools. An attacker with network access to the HTTP interface can exploit a lack of proper authorization checks, gaining unauthorized read access to any data exposed by the tool. This does not provide code execution or denial‑of‑service capabilities, but it allows the disclosure of sensitive business information.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are vulnerable. The affected component is the Portal SEC module.

The base score of 5.9 on the CVSS 3.1 scale indicates moderate severity with a confidentiality impact. The EPSS score is less than 1%, reflecting a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so there is no currently known active exploitation. The lack of authentication and the use of standard HTTP as the attack vector make it an attractive target for opportunistic attackers, yet evidence of real‑world exploitation is not yet observed.