The vulnerability allows an unauthenticated attacker who can reach the JD Edwards EnterpriseOne Tools over HTTPS to compromise the Interoperability SEC component and gain unauthorized access to critical data or full access to all data stored in the tool. It is an instance of Information Disclosure (CWE-200) and is scored as a moderate confidentiality impact in CVSS 3.1 with a Base Score of 5.9.

Oracle Corporation’s JD Edwards EnterpriseOne Tools product is affected, specifically versions 9.2.0.0 through 9.2.26.5, which include the Interoperability SEC component. Administrators should verify if their deployments fall within this range.

The CVSS v3.1 Base Score of 5.9 reflects a moderate risk primarily affecting confidentiality, with no impact on integrity or availability. The EPSS score indicates a very low but non‑zero exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Although the exploit is described as difficult, an attacker who can reach the tool over HTTPS may still attempt the vulnerable transaction. Defenses should assume the possibility of unauthorized access until a fix is applied.