The vulnerability in JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with network access to HTTP to compromise the system. Successful exploitation requires a person other than the attacker to interact with the system, but once active it can result in a takeover, affecting confidentiality, integrity, and availability.

Oracle Corporation’s JD Edwards EnterpriseOne Tools product, specifically versions 9.2.0.0 through 9.2.26.5, is affected.

The CVSS vector indicates high severity (8.8) with local attack complexity and no required privileges; the need for user interaction mitigates immediate exploitability, but the lack of a publicly known exploit and absence from KEV suggest low current exploit probability. Nevertheless, an attacker can exploit this vulnerability over the network to gain full control of the application, leading to complete system takeover.