This vulnerability resides in the JD Edwards EnterpriseOne Tools installation security component. An attacker who has logged on locally with low privileges can exploit the flaw to compromise the tools. The successful exploitation can lead to unauthorized access to critical data or full access to all data exposed by JD Edwards EnterpriseOne Tools. The weakness corresponds to improper access control, resulting in a confidentiality impact.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, specifically the 9.2.0.0 through 9.2.26.5 release series. Any installation within this version range that runs on the target infrastructure is affected.

The CVSS v3.1 base score of 5.5 reflects a medium severity with local attack, low attack complexity, low privileges, no user interaction, and an impact limited to confidentiality. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Because the attack requires local access, the risk is highest for systems where privileged accounts are present. Low‑privileged users who can log on to the machine that hosts JD Edwards EnterpriseOne Tools can leverage the flaw without needing to bypass other security controls.