The vulnerability exists in the Installation Security component of JD Edwards EnterpriseOne Tools. An attacker who can log onto the infrastructure where the tools run can take full control of the application without needing higher privileges. This allows the attacker to compromise confidentiality, integrity, and availability of the JD Edwards environment, effectively overriding the application’s security controls. The weakness can be classified under the weakness listed as CWE-284, indicating unauthorized privilege escalation.

Oracle JD Edwards EnterpriseOne Tools from Oracle Corporation, versions 9.2.0.0 through 9.2.26.5, are vulnerable.

The CVSS base score of 7.8 signals a high severity risk. EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Based on the CVSS vector, the likely attack vector is Local (AV:L) with low attack complexity and no privileges required, but the attack does require user interaction (UI:R) from a person other than the attacker. This means that any user who can physically or remotely access the host infrastructure could potentially aid in exploitation if they cooperate with an adversary. No public exploit is known.