The vulnerability exists in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools and allows an attacker with network access to the SMTP service to perform unauthorized updates, inserts, or deletions of data accessible through the tools. The flaw also provides a limited ability to cause a partial denial of service. The weakness adversely impacts data integrity and system availability but does not affect confidentiality. The CVSS 3.1 score of 4.8 indicates medium severity, reflecting the limited impact and the high attack complexity described in the vector.

Oracle Corporation JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected.

The vulnerability has a CVSS base score of 4.8 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based SMTP access, and the flaw requires no user interaction or elevated privileges. Although the description states the exploitation difficulty is high, the potential for unauthorized data modification and a partial denial of service makes it a notable risk for exposed systems.