The vulnerability resides in the Business Logic Infra SEC component of Oracle JD Edwards EnterpriseOne Tools, allowing a low‑privileged attacker who has logged on to the underlying infrastructure to gain unauthorized control over the Tools. Successful exploitation can lead to the attacker performing update, insert, or delete operations on the data managed by the Tools, as well as reading sensitive information that should be protected. The weakness lies in insufficient access control, resulting in confidentiality and integrity impacts with no availability effect.

JD Edwards EnterpriseOne Tools versions 9.2.0.0 up to 9.2.26.5 are affected. The product is provided by Oracle Corporation as part of its JD Edwards EnterpriseOne suite. Administrators should verify each instance of JD Edwards EnterpriseOne Tools within their environment to determine if it falls within the stated version range.

The CVSS base score of 3.6 indicates a low overall severity, but the requirement for a low‑privileged user who can log in to the infrastructure limits the attack vector. No EPSS data is available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that exploitation may presently be limited. However, because the vulnerability permits unauthorized data modification and disclosure, the risk to data confidentiality and integrity remains significant for systems that rely on the JD Edwards EnterpriseOne Tools.