Vulnerability in the Monitoring and Diagnostics component of Oracle JD Edwards EnterpriseOne Tools allows an attacker who has local access to the system to modify, insert, or delete data that should otherwise be protected. Because the attack does not require administrative privileges, the flaw is a weakness in access control. Successful exploitation can lead to unauthorized changes to the system’s data and a partial denial of service of the tool, thereby affecting data integrity and availability.

Oracle JD Edwards EnterpriseOne Tools, Monitoring and Diagnostics component, versions 9.2.0.0 through 9.2.26.5.

The CVSS v3.1 calculation gives a 3.6 base score, indicating low to moderate severity with limited scope for impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to already have logon credentials on the infrastructure where JD Edwards tools run, which reduces the attack vector to local. Although the vulnerability is difficult to exploit, the potential for data tampering and partial service outage means that organizations that maintain these versions should investigate and mitigate promptly.