A flaw in the Monitoring and Diagnostics module of Oracle JD Edwards EnterpriseOne Tools allows an attacker who can physically access the host’s communication interface to bypass authentication and gain unauthorized read and write privileges. The vulnerability can be exploited to compromise the confidentiality of critical data and to modify, insert, or delete records, thereby damaging data integrity. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) indicates that local access is sufficient, and the impact on confidentiality is high while integrity is low but still significant.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected. The vulnerability resides in the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools.

The CVSS base score of 8.2 signals a high severity, and the lack of an EPSS score indicates no publicly available data on exploitation frequency. Because the exploitation requires physical access, the likelihood is lower than a remote attack but still serious due to the potential to compromise data and affect other JD Edwards components. The vulnerability is not listed in the CISA KEV catalog, so there are no known zero‑day exploit references as of now. The local attack vector and required physical proximity constrain the threat but do not eliminate risk.