The vulnerability originates from an error in the installation security component of Oracle JD Edwards EnterpriseOne Tools that allows a low‑privileged user who can log onto the host system to compromise the application. By exploiting this flaw the attacker achieves local privilege escalation, gaining full control over the JD Edwards EnterpriseOne Tools installation and thereby exposing confidentiality, integrity and availability of the data and services it manages. This issue corresponds to CWE‑269 indicating improper privilege management.

The affected product is Oracle Corporation’s JD Edwards EnterpriseOne Tools, specifically the installation security component. Versions from 9.2.0.0 through 9.2.26.5 are listed as vulnerable. No other versions were indicated in the vendor’s security alert.

The CVSS v3.1 base score of 7.8 reflects a high severity that includes confidentiality, integrity and availability impact. The attack vector is local (AV:L), the access required is low (AC:L) and the privilege level needed is low (PR:L), meaning only a local user account is sufficient to attempt exploitation. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not included in the CISA KEV catalog, so the likelihood of exploitation cannot be quantified at this time, but the combination of a readily exploitable local flaw and the high impact warrants prompt action.