JD Edwards EnterpriseOne EUVD-2026-106369

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware running JD Edwards EnterpriseOne Tools (CVSS AV:A) - it cannot be performed from an arbitrary remote/internet location. No authentication is required (PR:N) and no user interaction is needed (UI:N), but AC:H indicates success depends on specific, non-deterministic conditions (e.g., timing or traffic state) that the attacker does not fully control. The practical limiting factor is network topology: hosts isolated on trusted, segmented VLANs with no untrusted devices on the same segment are not realistically exposed. Affected deployments are JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 (Enterprise Infrastructure SEC component).

This is a moderate, not high, priority. The Oracle CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 5.9) is driven by a high confidentiality impact but is heavily constrained by two factors: AV:A requires the attacker to be on the same physical/adjacent communication segment as the host running JD Edwards EnterpriseOne Tools - this is NOT internet-reachable, remote exploitation - and AC:H indicates non-trivial, condition-dependent exploitation. PR:N (unauthenticated) raises the score but is offset by the adjacency and complexity requirements. No EPSS score, KEV listing, or POC was provided in the input, so there is no positive signal of real-world exploitation; absence of these is expected for a freshly disclosed Oracle Critical Patch Update item and should not be read as either safe or exploited. Net: a genuinely high-CVSS-feeling confidentiality flaw whose real-world risk is substantially lowered by the adjacent-network precondition and high attack complexity - treat as patch-in-normal-cycle unless the JD Edwards host sits on a segment shared with untrusted devices. Note one conflicting metadata signal: the input Tag 'Authentication Bypass' is not supported by the description, which describes network-adjacent compromise rather than an auth-bypass mechanism - verify against the Oracle advisory.

An attacker who has gained a foothold on the same local/adjacent network segment as a JD Edwards EnterpriseOne Tools server (e.g., a compromised host or rogue device in the data-center VLAN) manipulates or observes Enterprise Infrastructure traffic to the application. Because the flaw is unauthenticated (PR:N) but adjacent-only (AV:A) and hard to exploit (AC:H), the attacker needs favorable timing or conditions to succeed, after which they can read critical JD Edwards data and perform limited unauthorized writes. No public exploit identified at time of analysis.