The vulnerability arises in the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools, permitting an unauthenticated attacker who can reach the system via HTTP to compromise the application. The flaw enables the attacker to modify, insert, or delete data and read a subset of accessible data, thereby affecting confidentiality and integrity. Successful exploitation does not grant immediate full control but allows a human interaction—typically involving a user other than the attacker—to further leverage the compromised state.

Oracle Corporation's JD Edwards EnterpriseOne Tools are impacted, specifically version ranges 9.2.0.0 through 9.2.26.5. The vulnerability is confined to the Monitoring and Diagnostics SEC component but may affect auxiliary products due to the scope change flag.

With a CVSS v3.1 base score of 6.1, the risk is moderate. The EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. Attackers need network-level HTTP access and rely on human interaction to fully exploit, yet the unauthenticated nature of the initial access increases the likelihood of reconnaissance and lateral movement within affected environments.