A vulnerability in the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools can be exploited by a low‑privileged user who has logon to the infrastructure where the tools run. Successful exploitation would allow the attacker to create, delete or modify critical data and gain full access to all data exposed by JD Edwards EnterpriseOne Tools, thereby compromising confidentiality and integrity.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5.

The CVSS 3.1 base score of 8.4 indicates a high‑severity flaw that can be easily exploited. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, but the presence of a scope change means that an attack could also affect other products in the JD Edwards environment. The likely attack vector is a local or internal compromise where the attacker has existing logon rights on the infrastructure hosting the tools.