The vulnerability is a remote flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools that permits an attacker with low privileges and network access through JDENET to bypass authentication controls and retrieve sensitive data. This results in a confidentiality breach, allowing access to all data exposed by the JD Edwards instance. The weakness corresponds to CWE‑200, reflecting an information disclosure flaw inherent in the authentication mechanism.

Oracle JD Edwards EnterpriseOne Tools versions from 9.2.0.0 through 9.2.26.5 are affected. These releases support JDENET connectivity and are commonly deployed in enterprise resource planning environments that rely on the JD Edwards platform.

The CVSS v3.1 score of 6.5 indicates moderate severity with a high impact on confidentiality. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet. The likely attack vector is network‑based, requiring only low privilege and JDENET access, so environments with poorly controlled JDENET traffic remain susceptible.