A vulnerability in the JD Edwards EnterpriseOne Tools Web Runtime Security component permits unauthenticated HTTP attackers to perform unauthorized update, insert, or delete operations on accessible data if they can trigger the flaw through human interaction. The flaw is due to improper access control and does not expose sensitive information, but allows an attacker to alter data integrity, thereby potentially corrupting business records and undermining trust in the application. In addition, the requirement for human interaction suggests the possibility of a Cross‑Site Request Forgery attack, inferred from the nature of the flaw.

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 to 9.2.26.5.

The base CVSS score is 3.1, indicating a low severity impact on integrity. EPSS is reported at <1%, signifying a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP and requires an unauthenticated attacker to convince a user to interact with the target, which further reduces the likelihood of successful exploitation, but it still poses a risk of data tampering.