An installation‑level flaw in Oracle JD Edwards EnterpriseOne Tools exposes a network service that allows an unauthenticated attacker to log in and gain full access to all data handled by the application. This flaw is a CWE‑200 Information Exposure weakness, and the vulnerability provides a severe confidentiality breach, as shown by the CVSS vector with high confidentiality impact and no authentication required.

Affected vendors and products are Oracle Corporation’s JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5. No other versions or components are listed as impacted.

The CVSS v3.1 base score of 7.5 indicates a high likelihood of successful exploitation. EPSS is below 1%, suggesting a very low current exploitation probability, but the description confirms the vulnerability is easily exploitable over Oracle Net. It is not listed in the CISA KEV catalog, which suggests limited known exploitation in the wild so far. An attacker with network access can exploit the flaw without requiring user credentials, making the risk significant for any environment that exposes Oracle Net services to external or untrusted networks.