A flaw in the JD Edwards EnterpriseOne Tools component known as Package Build SEC permits a low‑privileged attacker to send HTTP requests to the system that result in unauthorized creation, deletion or modification of critical data. The same exploit can trigger hangs that lead to a full denial of service. The weakness is an improper access control mechanism, which is reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H and targets integrity and availability.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5. All modules on these releases, including the Package Build SEC feature, are affected.

The CVSS base score of 8.1 indicates high severity with substantial impact on data integrity and system availability. The EPSS score is not available, but the low attack complexity and low privilege requirement suggest that exploitation is practical. The vulnerability is not yet listed in the CISA KEV catalog, but the remote attack vector over HTTP and the requirement for only low‑privileged access infer that it could be abused from the network to compromise JD Edwards tools. Successful attacks would allow an adversary to alter or delete data and to cause repeatable service interruptions.