A flaw in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools reflects weaknesses in resource management (CWE-404). It allows an unauthenticated local user who has already logged onto the infrastructure to manipulate the tool and trigger a partial denial of service. The vulnerability does not provide confidentiality or integrity compromise; it only degrades the tool’s availability, potentially interrupting business processes that rely on the application.

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. Any installation of JD Edwards EnterpriseOne Tools within this version range, regardless of operating system or network configuration, is vulnerable if a user with local logon rights has access to the underlying infrastructure.

The CVSS v3.1 score of 3.3 reflects a low to moderate severity with an availability impact. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation has not been observed. Attackers must first obtain a local logon to the infrastructure where JD Edwards EnterpriseOne Tools runs; this requirement is inferred from the AV:L and PR:N entries in the CVSS vector. Once local access is achieved, the flaw can be exercised through user interaction, as the vector indicates UI:R and the description notes that human interaction from a person other than the attacker is needed. Exploitation can cause the tool to fail or restart, producing a partial loss of service but not enabling code execution or data disclosure.