Vulnerability in the Business Logic Infrastructure Security component of Oracle JD Edwards EnterpriseOne Tools allows an attacker who can access the system over HTTP and who is only a low‑privileged user to fully compromise the application. Successful exploitation leads to the takeover of JD Edwards EnterpriseOne Tools, giving the attacker complete confidentiality, integrity, and availability control of the affected system. The weakness is an instance of improper access control, allowing a request that should be restricted to be carried out by a low‑privileged actor.

Oracle Corporation’s JD Edwards EnterpriseOne Tools are affected, specifically all supported versions from 9.2.0.0 through 9.2.26.2. No patch or workaround has been published by Oracle. The product provides enterprise resource planning functionality for business applications.

With a CVSS score of 8.8 it is considered high impact. The EPSS score of less than 1% indicates a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is over the network via HTTP, requiring only low privileges and no user interaction, meaning that a remote attacker with access to the exposed HTTP interface can potentially leverage the flaw to compromise the entire JD Edwards EnterpriseOne Tools instance.