A vulnerability in JD Edwards EnterpriseOne Localizations (file name LATAM component) permits an attacker with low privileges who can reach the system over JDENET to read a subset of results that the application exposes and to trigger a partial denial of service. The failure stems from insufficient privilege checks that allow information disclosure and an unexpected error condition when a malicious or malformed request is sent. As the impact is limited to confidentiality and availability, the compromise does not extend to integrity or authentication.

Oracle Corporation’s JD Edwards EnterpriseOne Localizations, version 9.2, is the only affected release listed. No other product lines or earlier versions were indicated as vulnerable.

The CVSS 3.1 base score is 5.4 with low exploitation effort and low privilege requirements. The EPSS score is not available, giving no indication of current exploitation likelihood; the vulnerability is not recorded in the CISA KEV catalog. Attackers must already have network connectivity to the JDENET interface and a valid low‑privileged account to exploit the flaw. Once exploited, the attacker can read restricted data and cause a partial disruption of the Localizations service.