The vulnerability in the JD Edwards EnterpriseOne Tools falls under the Enterprise Infrastructure SEC component and permits unauthenticated attackers who have access to a physical communication segment that connects to the system’s hardware. By exploiting this weakness, an attacker can create, delete, or modify critical data and gain unauthorized access to all the data accessible through JD Edwards EnterpriseOne Tools. The flaw leads to significant confidentiality and integrity damage, although it does not affect availability.

Affected vendors and products are Oracle Corporation’s JD Edwards EnterpriseOne Tools. The impacted releases are 9.2.0.0 through 9.2.26.5. No additional product lines or patch levels are listed, so any deployment within this version range is considered vulnerable.

The CVSS v3.1 base score is 8.1, indicating a high severity. The vector indicates an adjacent network attack with low authentication and no user interaction requirements, and the lack of Privileges Required and Impact on Availability reduce the scope to confidentiality and integrity. Because the EPSS score is not available, we cannot determine a precise exploitation probability, but the absence from the KEV catalog suggests no known active exploitation. Nevertheless, the requirement of local or network proximity means that any employee or attacker with direct physical or local network access could potentially exploit the flaw, making it a low‑bar to reach for insiders or compromised network devices.