The affected component is the Installation Security function of Oracle JD Edwards EnterpriseOne Tools. An unauthenticated attacker who has access to the infrastructure where the tools run can exploit the vulnerability and compromise JD Edwards EnterpriseOne Tools, ultimately taking control of the application. The impact is severe, affecting confidentiality, integrity, and availability of the system, as reflected in the CVSS 3.1 base score of 7.8.

Oracle Corporation’s JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. No other products or versions are listed as impacted.

The attack vector is local (AV:L) and requires an attacker to be able to log on to the hosting infrastructure. While authentication is not required, the exploit still demands human interaction from an entity other than the attacker, and no remote user can trigger it. The high confidentiality, integrity, and availability impact reflected in the CVSS score indicates a significant risk; however, the EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog, so the current exploitation likelihood is uncertain but the potential impact remains high.