The vulnerability resides in the JD Edwards EnterpriseOne Tools component E1 Dev Platform Tech – UNIX. An unauthenticated attacker who can reach the service over HTTP can trigger a compromise that grants unauthorized update, insert or delete actions, as well as read access to a subset of data exposed by the platform. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates moderate confidentiality and integrity impact without affecting availability.

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. The issue is specific to the E1 Dev Platform Tech – UNIX component. Any systems running these versions and exposed to the network via HTTP are susceptible.

Exploitability is medium; the attacker needs network access and basic interaction from a person other than the attacker. The CVSS score of 5.4 indicates a moderate risk, and the EPSS score of <1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Though no privileged credentials are required, the need for user action suggests that the attack may be carried out through social engineering or accidental exposure rather than purely automated exploitation.