Jd Edwards Enterpriseone
Monthly
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.