CVE-2025-21515

Name of the Vulnerable Software and Affected Versions JD Edwards EnterpriseOne Tools versions prior to 9.2.9.0

Description The issue is related to a lack of authentication for a critical function in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools. This can be exploited by a remote attacker using a specially crafted HTTP request, potentially impacting the confidentiality, integrity, and availability of protected information. Successful attacks can result in the takeover of JD Edwards EnterpriseOne Tools.

Recommendations For versions prior to 9.2.9.0, update to version 9.2.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Web Runtime SEC component to minimize the risk of exploitation. Additionally, limit network access via HTTP to reduce the attack surface.