The flaw in JD Edwards EnterpriseOne Tools allows an unauthenticated attacker who has physical access to the hardware communication segment to bypass authentication and read or modify critical application data. This is a data confidentiality and integrity problem consistent with CWE-200 (Information Exposure). The vulnerability stems from improper installation logic in the Enterprise Infrastructure SEC component, which fails to enforce authentication before data operations. As a result, an attacker can obtain confidential information with high impact and can insert or delete data with low to moderate impact. The CVSS score of 5.9 reflects moderate severity, with a vector of AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N.

Oracle’s JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. No other versions are known to contain the flaw. The vulnerability is documented in the Oracle CPU October 2026 advisory and applies to installations that have not applied the issued patch.

The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale known exploitation. Attack requires local, physical proximity to the server hosting JD Edwards EnterpriseOne Tools, no user credentials, and no user interface. Given its local nature, the risk is moderate: confidentiality is fully compromised while integrity is partially affected, yet external attackers would need to be physically present on the hardware.