The JD Edwards EnterpriseOne Tools Monitoring and Diagnostics SEC component contains a vulnerability that can be exploited by a high‑privileged attacker who has network connectivity and can send SQL commands. The flaw allows the attacker to read sensitive data, and to insert, update or delete records in the JD Edwards database, potentially giving full control over the data accessible through the tools. This is a classic SQL injection flaw that compromises confidentiality and, with scope changes, can lead to integrity violations across the entire system.

Oracle JD Edwards EnterpriseOne Tools is impacted, specifically the Monitoring and Diagnostics SEC component. Versions from 9.2.0.0 through 9.2.26.5 are affected. No other Oracle product versions are currently listed as vulnerable.

The CVSS v3.1 score of 6.6 indicates a moderate severity vulnerability with high confidentiality impact and low integrity impact, but the scope change increases the potential reach to all data exposed by JD Edwards EnterpriseOne Tools. The EPSS score is <1% (0.00259), indicating a very low but non-zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to target the tool remotely over the network by injecting malicious SQL commands; successful exploitation would grant them unauthorized read, write or delete access to the application’s data.