EnterpriseOne Tools EUVD-2026-106368

Requires network HTTP access to a JD Edwards EnterpriseOne Tools server (versions 9.2.0.0 through 9.2.26.5) running the Enterprise Infrastructure SEC component; no authentication and no user interaction are required (PR:N, UI:N). The key LIMITING factor is High attack complexity (AC:H): Oracle rates this 'difficult to exploit', indicating the attacker must overcome conditions outside their control - plausibly specific timing/race conditions, a non-default or particular configuration state, or server-specific information gathered through reconnaissance - before the attack succeeds. Exploitation is further bounded to confidentiality: it yields data disclosure only and cannot alter data or affect availability. Exposure is reduced where the JD Edwards HTTP interface is not reachable by untrusted networks.

This is a medium-severity confidentiality-only flaw (CVSS 3.1 base 5.9) in Oracle JD Edwards EnterpriseOne Tools, disclosed in the October 2026 Oracle Critical Patch Update. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) presents a mixed risk signal: it is network-reachable and unauthenticated (PR:N, UI:N) - attractive to attackers - but carries High attack complexity (AC:H), meaning successful exploitation depends on conditions outside the attacker's control (e.g. race conditions, specific configuration, or reconnaissance of the target). Impact is limited to confidentiality (C:H, I:N, A:N): an attacker can read all JD Edwards-accessible data but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization. SSVC-style framing: exploitation status is 'none' (no public exploit identified), automatability is low given AC:H, and technical impact is partial (confidentiality only). Net: this is a legitimate patch-priority item for JD Edwards operators due to the unauthenticated network vector and total confidentiality loss, but it is NOT a drop-everything emergency absent exploitation signals - the AC:H rating and lack of KEV/POC suggest it is not trivially or widely exploitable. CAVEAT: CWE is N/A and the input 'Authentication Bypass' tag is not corroborated by the description (which describes unauthenticated data access, not a bypass of an auth control); treat the vulnerability class as unconfirmed pending Oracle detail, which Oracle's CPU advisories characteristically withhold.

A remote, unauthenticated attacker with HTTP network access to an internet-exposed or internally-reachable JD Edwards EnterpriseOne Tools server crafts requests against the Enterprise Infrastructure (SEC) component to extract sensitive business data. Because attack complexity is High, the attacker likely must satisfy additional conditions (timing, configuration, or prior reconnaissance) before the attack reliably succeeds. No public proof-of-concept exploit is known at the time of analysis.