EnterpriseOne Tools EUVD-2026-106519

No special conditions beyond network reachability - the vector is AV:N/AC:L/PR:N/UI:N, meaning any attacker who can send HTTP requests to a JD Edwards EnterpriseOne Tools instance (Enterprise Infrastructure SEC component, versions 9.2.0.0 through 9.2.26.5) can exploit it without credentials or user interaction. The practical limiting factors are therefore network exposure (the instance must be reachable by the attacker, e.g. internet-facing or on a reachable internal segment) and running an affected 9.2.x version; there is no stated non-default configuration, feature toggle, or platform requirement. Availability is not impacted (A:N), so exploitation targets data confidentiality and integrity rather than service disruption.

This is a genuine high-priority vulnerability, not an inflated-score artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the easiest-to-exploit profile: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction, yielding a 9.1 base score driven by High confidentiality and integrity impact (availability is unaffected, A:N). Oracle's own description reinforces this with 'easily exploitable' and 'unauthenticated attacker.' The limiting signals are the softer threat-intelligence indicators: no EPSS exploitation-probability score is provided, the vulnerability is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag is consistent with the PR:N vector but the description does not technically characterize the flaw (CWE is N/A), so the exact mechanism is unconfirmed. Net: treat as a high priority for any internet- or intranet-exposed JD Edwards EnterpriseOne Tools instance because exploitation prerequisites are minimal, while noting that active exploitation is not currently evidenced - prioritize patching but the urgency is driven by exploitability, not confirmed in-the-wild activity.

An attacker with network access sends crafted HTTP requests to an exposed JD Edwards EnterpriseOne Tools instance (versions 9.2.0.0 through 9.2.26.5) and, without any credentials or user interaction, gains unauthorized read and write access to business-critical ERP data. Given the low attack complexity (AC:L) and no authentication requirement, a single reachable endpoint is sufficient; no public exploit code is currently identified, but the vector makes reliable exploitation straightforward once the technical flaw is understood.