This vulnerability allows an unauthenticated attacker with network access via JDENET to compromise Oracle JD Edwards EnterpriseOne Tools. Successful exploitation can result in unauthorized creation, deletion or modification of critical data and unrestricted access to all data accessible through the tools, significantly impacting confidentiality and integrity of enterprise information. The lack of authentication and the high impact on data integrity make this flaw a serious risk to any organization relying on JD Edwards for critical business processes.

Affected by Oracle Corporation, JD Edwards EnterpriseOne Tools product. Versions from 9.2.0.0 through 9.2.26.5 are vulnerable. The flaw resides in the Interoperability SEC component accessed over JDENET.

The CVSS 3.1 base score of 7.4 indicates a high‑severity vulnerability. Exploitability is plausible due to network accessibility, with no authentication required and a high attack complexity setting. While the EPSS score is currently unavailable and the vulnerability is not yet listed in CISA KEV, the potential for unauthorized data manipulation means the risk to organizations remains significant. The likely attack vector is via direct JDENET traffic from an unauthenticated external host.