The vulnerability enables a low‑privileged attacker with network connectivity to JDENET to read a subset of JD Edwards EnterpriseOne Tools data and trigger a partial denial of service. The weakness manifests as insufficient access control, allowing users to bypass normal permissions and obtain confidential information with limited impact on other system functions. This results in a moderate confidentiality compromise and a limited availability degradation, reflected in the CVSS 5.4 score.

Oracle JD Edwards EnterpriseOne Tools versions from 9.2.0.0 to 9.2.26.5 are impacted. All installations of the Business Logic Infra SEC component within this range are susceptible.

The CVSS base score of 5.4 indicates moderate severity, with low attack complexity and low required privileges. The EPSS score is currently unavailable, so exploitation likelihood cannot be quantified, but the attack is described as "easily exploitable" via network access through JDENET. The vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed, widespread exploitation yet. Attackers would typically send crafted requests over JDENET to read data and potentially drain resources to cause service interruption, exploiting the lack of proper authorization checks.