The vulnerability resides in the Enterprise Infrastructure SEC component of JD Edwards EnterpriseOne Tools. It permits an attacker with local logon rights on the infrastructure hosting the tools to gain control of the tools component. Successful exploitation allows the attacker to create, delete, or modify critical data and to read or otherwise access all data stored in JD Edwards EnterpriseOne Tools, thereby breaching confidentiality and integrity of that data. The described flaw is a local privilege escalation that results in unauthorized data manipulation and disclosure.

Oracle Corporation’s JD Edwards EnterpriseOne Tools is affected. Versions 9.2.0.0 through 9.2.26.5, as listed in the advisory, contain the flaw in the Enterprise Infrastructure SEC component. The vulnerability was reported in the October 2026 Oracle CPU advisory.

An attacker only needs a low‑privilege local account on the host running JD Edwards EnterpriseOne Tools to exploit the issue, which makes the attack vector local, with low complexity and low privilege, yielding a CVSS 3.1 score of 7.1. The EPSS score of less than 1 % implies a very low likelihood of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, because the flaw can lead to extensive data modification or disclosure, environments that store sensitive information in JD Edwards EnterpriseOne Tools should treat the risk as significant and apply mitigations promptly.