An access control flaw in the Installation Security component of JD Edwards EnterpriseOne Tools allows an unauthenticated attacker to access the tools over HTTP. The vulnerability requires the attacker to rely on another human to trigger the exploit, but once triggered it grants the attacker full control of the tools, compromising confidentiality, integrity, and availability of the application.

Oracle Corporation JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected.

The flaw carries a CVSS 3.1 Base Score of 8.8, indicating high severity. The EPSS score is 0.00288 (0.288%), indicating a very low probability of exploitation. The issue is not listed in CISA KEV. Exploitation requires network access to the HTTP interface but can be carried out by an unauthenticated user; the need for a third‑party human interaction limits automation but does not eliminate risk. Successful exploitation results in full takeover of the JD Edwards EnterpriseOne Tools, providing the attacker with the same capabilities as the system administrator.