JD Edwards EnterpriseOne EUVD-2026-106423

Exploitation requires the attacker to already hold a low-privileged, authenticated JD Edwards EnterpriseOne account (PR:L) with network reachability to the Operational Sourcing component via the SMTP vector; version 9.2 must be deployed. Limiting factors: valid low-level credentials are mandatory (this is not an unauthenticated flaw despite the 'Authentication Bypass' tag), impact is confined to confidentiality (no integrity or availability effect), and reachability depends on the SMTP interface being network-accessible to the attacker rather than isolated behind internal segmentation.

This is a moderate-priority, not critical, issue. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-exploitable with low attack complexity and no user interaction, but it requires an authenticated low-privileged account (PR:L) and only impacts confidentiality (C:H; I:N/A:N). Oracle labels it 'easily exploitable,' which aligns with AC:L. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The absence of exploitation signals combined with the PR:L requirement suggests real-world urgency is lower than the raw score implies; prioritize patching for internet-exposed or multi-tenant JD Edwards deployments where low-privileged accounts are broadly provisioned. Note a metadata conflict: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L requirement and Oracle's 'low privileged attacker' description - this flaw presupposes valid low-level credentials rather than bypassing authentication, so the tag appears mislabeled and should not drive prioritization.

An attacker holding a low-privileged JD Edwards EnterpriseOne account (or who has compromised such credentials) sends crafted input through the SMTP-facing Operational Sourcing component over the network. Because attack complexity is low and no user interaction is needed, the attacker reliably reads confidential sourcing data they should not have access to, potentially gaining complete read access to all data accessible to the Operational Sourcing module. No public exploit code was identified in the provided intelligence.