The vulnerability in JD Edwards EnterpriseOne Tools allows a low privileged attacker with network access via JDENET to initiate a partial denial of service, impacting availability of the application. The flaw resides in the Business Logic Infra SEC component and has been rated with a CVSS 3.1 base score of 4.3. The vulnerability does not provide escalation or compromise of confidentiality or integrity, but it can disrupt business processes by reducing the service’s responsiveness.

The affected versions of JD Edwards EnterpriseOne Tools are from 9.2.0.0 through 9.2.26.5. The product is used by organizations that rely on Oracle JD Edwards for enterprise resource planning and requires JDENET connectivity. Any installation of the affected releases that exposes JDENET to untrusted networks is at risk. The CVE entry does not list additional affected subcomponents or platform specifics beyond the tools component.

The risk is moderate, reflected by the CVSS base score of 4.3. The EPSS score of 0.26% indicates a very low probability of exploitation. However, the exploit path requires only network connectivity to JDENET and low‑privilege access, making it realistic in environments that have not isolated JDENET traffic. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known. Administrators should treat the vulnerability as a low to medium risk that warrants timely patching and network segmentation to mitigate potential availability disruptions.