This vulnerability in Oracle JD Edwards EnterpriseOne Tools permits a low‑privileged user who can log on to the infrastructure where the tool runs to create, delete, or modify critical data, as well as gain unauthorized access to all data accessible through the tool. The issue is hard to exploit, but a successful attack results in confidentiality and integrity impacts with a CVSS v3.1 base score of 6.3. The vulnerability arises from missing or improper access control mechanisms that allow privileged operations to be performed without proper authorization.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected. The vulnerability is present in the Enterprise Infrastructure SEC component of these releases.

The CVSS score indicates moderate severity with significant confidentiality and integrity consequences. EPSS data is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a local user or service on the infrastructure that can run the JD Edwards EnterpriseOne Tools; the attacker must be able to log on with low privileges to trigger the exploitation path. While exploitation requires difficult conditions, the potential impact warrants prompt attention.