A vulnerability exists in the JD Edwards EnterpriseOne Tools product’s Enterprise Infrastructure SEC component that permits an attacker with network access via HTTP to exploit the system without authentication. The flaw can lead to unauthorized read access, as well as insert, update, or delete operations on data that the tool can view. Because the vulnerability is associated with a scope change, successful exploitation may also affect additional JD Edwards products beyond the tools component.

Oracle Corporation’s JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5.

The CVSS v3.1 base score of 6.1 reflects moderate confidentiality and integrity impact, while the EPSS score is not disclosed and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker to send crafted HTTP requests to the JD Edwards server and an unrelated user to interact with the tools; this dependency on human interaction reduces the ease of exploitation compared to fully automated attacks. Nevertheless, given the potential for data tampering and the scope change, the risk remains significant for environments where JD Edwards EnterpriseOne Tools is exposed over the network.