The vulnerability resides in the Installation Security component of JD Edwards EnterpriseOne Tools, allowing an attacker with local logon rights to compromise the application. This flaw results in complete takeover, corrupting confidentiality, integrity and availability with an overall CVSS base score of 7.8. Because the attack requires no user interaction, a low effort adversary can elevate privileges locally.

Affected vendors and products are Oracle JD Edwards EnterpriseOne Tools, versions ranging from 9.2.0.0 through 9.2.26.5. The flaw is present in the installation processes executed on the infrastructure that hosts the tools, enabling operators with non‑administrative accounts to gain control.

The CVSS score of 7.8 reflects a high impact, while the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. The CVE states that a low‑privileged user who has logged on to the infrastructure can exploit the vulnerability to compromise JD Edwards EnterpriseOne Tools, but the specific attack vector and methodology are not detailed in the advisory. The impact includes complete takeover of the application with confidentiality, integrity and availability loss.