The JD Edwards EnterpriseOne Tools product includes the Enterprise Infrastructure SEC component, which contains a vulnerability that can be triggered by an attacker who has local low‑privilege access to the infrastructure where the tools run. An attacker can use the flaw to create, delete or alter critical data, read restricted information, or cause the tools to hang or crash, leading to a denial of service. The CVSS vector indicates low attacker access, high authentication, low privileges, no user interaction, with impacts on confidentiality, integrity and availability.

Oracle Corporation’s JD Edwards EnterpriseOne Tools is affected. The vulnerable releases are 9.2.0.0 through 9.2.26.5. All installations running these versions in the indicated range are susceptible until a patch is applied or a later version is deployed.

The base score of 6.5 classifies the vulnerability as medium severity. It requires local access and low privileges, so the attack window is limited to users who can log on to the infrastructure. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog, suggesting there is no known widespread exploitation yet. Nonetheless, the ability to alter or delete data and to interrupt service poses a significant risk to business continuity.