A flaw in the Deployment SEC component of Oracle JD Edwards EnterpriseOne Tools allows an attacker who has local logon access to the underlying infrastructure to compromise the Tools application. The vulnerability does not require any pre‑existing credentials within the application; however, the attacker must present themselves to a separate person who performs a required interaction. If the interaction is fulfilled, the attacker can gain complete control of the Tools, leading to loss of confidentiality, integrity, and availability of the system.

The affected product is Oracle JD Edwards EnterpriseOne Tools, specifically versions ranging from 9.2.0.0 through 9.2.26.5. The issue is limited to the Deployment SEC component within the Suite.

The CVSS v3.1 base score is 7.8, indicating a high‑severity flaw that can be easily exploited by a local attacker. The EPSS score is < 1%, indicating a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The required human interaction still provides an opportunity for successful exploitation in environments where users may unknowingly facilitate the attack. The attack vector is local, with no application privileges required, which increases the risk for systems that are exposed to multiple users with infrastructure access.