The vulnerability resides in the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools and allows an attacker who already has high privileges and network reachability via HTTP to compromise the tool. An adversary with such privileges can read critical data with high confidentiality impact and also perform unauthorized insert, update, or delete operations, resulting in integrity compromise. The flaw does not grant code execution but provides broad data manipulation rights within the affected system. This flaw is a CWE-284 Access Control weakness.

Oracle JD Edwards EnterpriseOne Tools; versions 9.2.0.0 through 9.2.26.5 are compromised. The attack surface is limited to the JD Edwards EnterpriseOne Tools product, but the effect can spill over to other related Oracle applications due to a change in scope.

The CVSS 3.1 base score of 6.6 reflects a moderate severity, with high confidentiality impact and low integrity impact. Attack requires network access over HTTP and the attacker must already possess high-level privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the scope change and the high privilege prerequisite suggest that within environments where users have elevated rights, the risk remains substantial.