A flaw in the installation security of Oracle JD Edwards EnterpriseOne Tools permits an attacker who can reach the physical communication segment connected to the tool’s hardware to compromise the system. The vulnerability is significant because it can lead to the full takeover of JD Edwards EnterpriseOne Tools, affecting confidentiality, integrity, and availability of the platform.

Affected products are Oracle JD Edwards EnterpriseOne Tools for versions 9.2.0.0 through 9.2.26.4. The flaw specifically targets the installation security component and is applicable to the JD Edwards EnterpriseOne Tools only, though successful exploitation may influence other related products due to scope change.

The CVSS v3.1 base score is 8.8, indicating high severity, but the EPSS score is not available, so the current probability of exploitation cannot be precisely measured. The vulnerability is not listed in the CISA KEV catalog, implying that it may not yet have known widespread exploitation. An attacker must have physical access to the hardware’s communication segment and must move a human interaction step, which raises the required effort but still represents a serious threat if such access can be obtained. The scope change suggests that compromise could extend beyond the primary tool to other applications in the environment.