The Oracle JD Edwards EnterpriseOne Tools product includes a flaw in the E1 Dev Platform Tech – UNIX component that allows a user with high privileged host login to perform unauthorized updates, inserts, or deletions on data exposed by the tools. The same elevation also permits a partial denial of service that can interrupt operations. Because the exploit requires local access and does not rely on user interaction, the vulnerability primarily threatens the integrity and availability of the application, but it does not expose data to external readers.

Oracle Corporation’s JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are susceptible. The weakness resides within the E1 Dev Platform Tech – UNIX component and affects any deployment running those releases.

The CVSS 3.1 base score of 3.4 reflects a low severity; the EPSS score of less than 1% indicates a very low probability of external exploitation, and the vulnerability is not listed in CISA’s KEV. The attack vector is local and requires an attacker already possessing high‑privileged host credentials; no additional user interaction is needed. In an environment where such privileges exist, an insider or compromised credential could immediately modify or erase application data and trigger a partial service outage. Therefore, the primary risk lies with privileged account management rather than exposure to the open network.