JD Edwards EnterpriseOne EUVD-2026-106346

Exploitation requires network reachability to the JD Edwards EnterpriseOne Tools SMTP mail-handling path within the Enterprise Infrastructure SEC component, affecting versions 9.2.0.0 through 9.2.26.5; no credentials and no user interaction are needed (PR:N/UI:N). The key limiting factor is high attack complexity (AC:H / Oracle 'difficult to exploit'): success depends on conditions not fully controlled by the attacker, such as specific message-processing state or timing, so reliable exploitation is non-trivial. Defenders can further constrain exposure by restricting/firewalling inbound SMTP to the EnterpriseOne Tools server and limiting which hosts can reach the mail interface.

This is a high-severity (CVSS 8.1) flaw in Oracle JD Edwards EnterpriseOne Tools whose signals point to a serious-but-not-emergency priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated vector over SMTP leading to full confidentiality, integrity and availability loss ('takeover'), which is why the score is high. The decisive mitigating signal is AC:H - Oracle explicitly labels it 'difficult to exploit,' meaning success depends on conditions outside the attacker's control (e.g., timing, specific message handling, or environmental state), which substantially lowers real-world exploitability. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the provided intelligence, so there is no evidence of active or at-scale exploitation; exploitation status is 'no public exploit identified at time of analysis.' Note a tagging conflict: the input Tags label this 'Information Disclosure,' but the description and CVSS (C:H/I:H/A:H, full takeover) indicate impact well beyond disclosure - treat the tag as inaccurate. Net: a genuine high-impact issue warranting prompt patching through Oracle's October 2026 CPU, but the high attack complexity and absence of exploitation signals argue against treating it as a drop-everything emergency relative to low-complexity unauthenticated RCEs.

An attacker with network access to the JD Edwards EnterpriseOne Tools SMTP-handling interface sends specially crafted mail traffic that abuses the Enterprise Infrastructure SEC component, and under the right (non-trivial) conditions this leads to full compromise of the EnterpriseOne Tools environment. No authentication or user interaction is required (PR:N/UI:N), but the high attack complexity (AC:H) means the attacker must satisfy conditions outside their direct control for reliable success. No public proof-of-concept or exploit code is identified in the available data.