A vulnerability exists in Oracle JD Edwards EnterpriseOne Tools, specifically within the installation security component, that permits an unauthenticated attacker with network reach through HTTPS to create, delete, or modify critical data. The flaw permits unauthorized manipulation of business data, resulting in breaches of confidentiality and integrity. The CVSS vector indicates high impact on confidentiality and integrity with a base score of 9.1, reflecting the potential for significant data compromise.

Versions of JD Edwards EnterpriseOne Tools from 9.2.0.0 up to and including 9.2.26.5 are affected. The vulnerability applies to all installations of these releases that expose the HTTPS installation interface.

With a CVSS score of 9.1 the risk is classified as critical. The exploit is deemed easily actionable, requiring only network access to the HTTPS endpoint; the attack vector is inferred from the description indicating vulnerability via HTTPS. The EPSS score is < 1% and the vulnerability is not present in the CISA KEV catalog, but the very low exploitation probability does not diminish the seriousness indicated by the high CVSS. An unauthenticated attacker could potentially compromise critical data or grant full access to all data accessible through JD Edwards EnterpriseOne Tools.