Vulnerability in the JD Edwards EnterpriseOne Tools product's Installation SEC component allows a low-privileged attacker with network access to the JDENET service to fully compromise the Tools installation. The flaw permits escalation of privileges and control over the affected system, resulting in loss of confidentiality, integrity, and availability. This vulnerability falls under Missing Authentication (CWE-306). The CVSS-3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that only basic network connectivity and low privileges are required, and no user interaction is needed.

The affected vendor is Oracle Corporation, product JD Edwards EnterpriseOne Tools. Oracle indicates that versions from 9.2.0.0 through 9.2.26.5 are vulnerable. No other versions or build numbers are listed. The flaw is specific to the JDENET installation component on enterprise-grade deployments.

The CVSS base score of 8.8 signals a high risk level. The EPSS score is less than 1%, suggesting the vulnerability has not yet seen widespread exploitation, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the JDENET interface does not enforce strict authorization controls, allowing low‑privilege accounts to perform privileged actions. Attackers likely need only network connectivity to JDENET and no additional user interaction, making the attack path straightforward for an internal or external attacker with access to the network.