The vulnerability resides in the installation security component of JD Edwards EnterpriseOne Tools, enabling low privileged users who can log on to the host to access the tool and compromise the system. This event allows an attacker to read or modify critical data stored by JD Edwards EnterpriseOne Tools. The weakness lies in improper access control (CWE‑284) that permits unauthorized data reading, and, since it can be exploited locally, leverages a privilege escalation path (CWE‑755).

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are impacted. The flaw affects the JD Edwards EnterpriseOne Tools installation security component and may allow attacks to extend beyond the tool to other JD Edwards products due to scope change.

The CVSS v3.1 base score is 6.5 with an attack vector of local, access complexity low, privilege requirement low, user interaction none, and a scope change. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who are able to log on to the infrastructure hosting JD Edwards can exploit this flaw to gain unauthorized access to critical data or to read all data accessible by JD Edwards EnterpriseOne Tools. The local nature of the attack means that mitigating host‑based controls is essential. The overall risk remains moderate, but the potential to affect confidentiality of JD Edwards data warrants prompt action.