The vulnerability resides in the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools, allowing an attacker with physical access to the hardware communication segment to read or modify data managed by the tool without any credentials or user interface. This grants unauthorized disclosure of critical enterprise data and potentially complete access to all data the Tool can see. The weakness is an access control flaw and is rated with a CVSS 3.1 Base Score of 5.3, reflecting medium severity driven solely by a confidentiality impact; integrity and availability are unaffected.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected. These versions lie under the Oracle Corporation umbrella and include the Monitoring and Diagnostics SEC component where the flaw exists.

With a CVSS score of 5.3 and an EPSS score of less than 1%, the likelihood of exploitation currently appears modest. The vulnerability is acknowledged in Oracle's October 2026 security alert, suggesting the issue may have been patched or mitigated by the vendor. In practice, exploitation requires physical proximity to the hardware’s communication interface, restricting the threat largely to insiders or individuals with substantial physical access. No user authentication or UI is needed, meaning an unauthenticated attacker who gains physical access can exploit the flaw. The system is not listed in the CISA KEV catalog, indicating no known active exploitation at this time.