The vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) permits a low‑privileged attacker who can reach the system through JDENET to update, insert, or delete HR data and to inflict a partial denial of service. It is identified as an integrity and availability issue with a CVSS 3.1 base score of 5.4, indicating a moderate severity. No user interaction is required, and the attack vector is network.

Products affected are Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. The vulnerability is limited to this release and has no known variants in other versions according to the CNA data.

The CVSS score of 5.4 reflects moderate impact; however, the lack of an EPSS score and the absence of listing in the CISA KEV catalogue suggest that exploitation, while possible, has not been widely observed. The necessity for only low privileges and network access via JDENET means that the attack could be launched from a compromised internal host or a nearby network, providing attackers with the ability to alter sensitive HR information or disrupt services for specific modules. The partial denial of service may hinder HR operations sufficiently to cause operational disruption, and the data tampering could lead to false records, affecting compliance and reporting.