The vulnerability exists in the Package Build SEC component of the JD Edwards EnterpriseOne Tools product and permits a high privileged attacker who has logged on to the infrastructure where the tools run to fully compromise JD Edwards EnterpriseOne Tools. Successful exploitation can result in the attacker taking full control of the tools, leading to confidentiality, integrity and availability impacts on the entire JD Edwards environment.

Oracle Corporation JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5.

The CVSS 3.1 score of 6.7 indicates a medium severity with local attack access but high privileges required. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, suggesting that it may not have widespread public exploits yet. Nevertheless, the attacker needs privileged local access to gain control of JD Edwards EnterpriseOne Tools, making the risk significant for systems where such privileges exist.