The vulnerability resides in the E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator. A low-privileged attacker with network access to the HTTP interface can exploit the flaw, leading to unauthorized disclosure of critical data or complete access to all Orchestrator data. The flaw is classed as a confidentiality-impacting weakness in the CVSS 3.1 vector with a base score of 6.5.

Oracle Corporation’s JD Edwards EnterpriseOne Orchestrator product, versions 9.2.0.0 through 9.2.26.5, is affected. The issue toggles the Orchestrator’s security controls for authorized users over the HTTP protocol.

The CVSS score of 6.5 coupled with a high likelihood for exploitation from a remote HTTP connection identifies a moderate to high risk scenario. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the vector indicates an easily exploitable network attack by a low-privileged user.