Loading vulnerability…
Unauthorized Data Access in Oracle JD Edwards EnterpriseOne Tools Web Runtime SEC
CVE-2025-21510 is an easily exploitable vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically in the Web Runtime SEC component. Affected versions are prior to 9.2.9.0. The flaw can be exploited by an unauthenticated attacker with network access over HTTP, allowing compromise of the JD Edwards EnterpriseOne Tools environment. The available information indicates the primary security impact is loss of confidentiality, enabling unauthorized access to sensitive application data exposed through the affected product.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through the affected JD Edwards EnterpriseOne Tools instance. The published CVSS 3.1 vector indicates high confidentiality impact, with no stated integrity or availability impact.
If you can’t patch tonight, do this now.
Restrict network exposure of JD Edwards EnterpriseOne Tools, especially HTTP-accessible interfaces, to trusted networks and authorized users only. Where immediate patching is not possible, use compensating controls such as network segmentation, access control enforcement, and monitoring of access to the Web Runtime SEC component until the fixed version can be deployed.
Patch, then assume compromise.
Upgrade Oracle JD Edwards EnterpriseOne Tools to version 9.2.9.0 or later and apply the relevant Oracle security updates from the January 2025 Critical Patch Update for affected deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.