EnterpriseOne Tools EUVD-2026-106361

Exploitation requires the attacker to already have an authenticated low-privilege account with interactive logon to the specific infrastructure host where JD Edwards EnterpriseOne Tools executes (AV:L, PR:L) - there is no remote or network path. The target is the Enterprise Infrastructure SEC component in Tools versions 9.2.0.0 through 9.2.26.5. The high attack complexity (AC:H) indicates additional non-default conditions, timing, or a race must be met beyond simply holding the account, which meaningfully limits reliable exploitation. No user interaction by a victim is needed (UI:N), and there is no availability impact (A:N). Primary limiting factors: mandatory local access, a pre-existing valid low-privilege credential, and the difficult, condition-dependent exploitation path.

This is a moderate-severity (CVSS 6.3) vulnerability in Oracle JD Edwards EnterpriseOne Tools whose real-world risk is tempered by its exploitation profile rather than elevated by it. The CVSS vector (AV:L/AC:H/PR:L) requires local logon to the host where the Tools execute, a pre-existing low-privilege account, and a high-complexity attack - three stacked barriers that make opportunistic or mass exploitation unlikely. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation; absence of these signals is not proof of safety but is consistent with the difficult-to-exploit, locally-scoped nature. The impact side is serious once conditions are met: C:H/I:H means full read and modify/delete access to all JD Edwards-accessible data (A:N - no availability impact). Note a labeling conflict: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L requirement and the description's explicit 'low privileged attacker with logon' - this is NOT an unauthenticated bypass, so the tag should be treated with skepticism. Overall this is a credible insider/post-foothold privilege-and-data risk, not an internet-facing emergency; prioritize via the Oracle October 2026 CPU patch cycle rather than as a break-glass item.

An attacker who already holds a low-privilege local account on the server where JD Edwards EnterpriseOne Tools runs (e.g., a limited operational or application user) performs a complex local sequence against the Enterprise Infrastructure SEC component to escalate their data access. On success they can read, create, modify, or delete all data the Tools can reach. The high attack complexity (AC:H) means the attacker must satisfy non-trivial conditions or win a race/timing-dependent step, and no public exploit code is identified at time of analysis.