This vulnerability affects Oracle JD Edwards EnterpriseOne Tools, specifically version 9.2.26.3. It involves a weakness in the Installation Security component that can be exploited by an unauthenticated attacker who has physical access to the communication segment attached to the hardware running the software. Exploitation requires human interaction from a third party. The impact includes unauthorized modification (update, insert, delete) and limited unauthorized reading of accessible data. The CVSS 3.1 vector indicates attack complexity is high, no privileges required, user interaction is required, and the scope is unchanged. The base score is 3.7, indicating a low severity vulnerability. No known exploits are reported in the wild. Oracle’s July 2026 Critical Patch Update advisory lists this vulnerability but does not explicitly state a patch or remediation level for this specific issue. Customers are advised to apply available patches promptly and remain on supported versions.

The vulnerability allows unauthorized update, insert, or delete operations and limited unauthorized read access to some data accessible by JD Edwards EnterpriseOne Tools. However, exploitation is difficult due to the requirement for physical access to the communication segment and the need for human interaction from a person other than the attacker. The confidentiality and integrity impacts are low, and there is no impact on availability. No known exploits are reported in the wild.

Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly confirm a patch or remediation level for it. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Given the difficulty of exploitation and the requirement for physical access and human interaction, organizations should also ensure physical security controls around hardware running JD Edwards EnterpriseOne Tools.