Loading vulnerability…
Unauthorized Information Disclosure in Oracle JD Edwards EnterpriseOne Tools Web Runtime SEC
CVE-2025-21514 is an easily exploitable vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically in the Web Runtime SEC component. Affected versions are prior to 9.2.9.0. An unauthenticated attacker with network access over HTTP can exploit the flaw to compromise the product and obtain unauthorized read access to a subset of data accessible through JD Edwards EnterpriseOne Tools. The available information indicates an information disclosure issue affecting confidentiality, but does not provide sufficient technical detail about the vulnerable function or root cause to map it confidently to a specific weakness class.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized disclosure of a subset of data accessible through JD Edwards EnterpriseOne Tools. The documented security impact is limited to confidentiality, with no stated integrity or availability impact. The published CVSS v3.1 vector indicates network-based exploitation with low attack complexity and no authentication or user interaction required.
If you can’t patch tonight, do this now.
Restrict network exposure of JD Edwards EnterpriseOne Tools, particularly HTTP access to the Web Runtime SEC component, to only trusted administrative or application networks until the patch can be applied. Where immediate upgrading is not possible, use network segmentation and access controls to reduce unauthenticated reachability.
Patch, then assume compromise.
Upgrade Oracle JD Edwards EnterpriseOne Tools to version 9.2.9.0 or later and apply the relevant Oracle security update addressing CVE-2025-21514.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.