JD Edwards EnterpriseOne EUVD-2026-106525

Exploitation requires an authenticated low-privileged account on JD Edwards EnterpriseOne Tools (PR:L) with network HTTP access to the Monitoring and Diagnostics (SEC) component; only versions 9.2.0.0 through 9.2.26.5 are affected. No user interaction is required and attack complexity is low. The primary limiting factors are the need for valid (even minimal) credentials and network reachability of the EnterpriseOne web tier - internet-exposed instances face materially higher risk than those restricted to internal networks. There is no availability impact, so this is a confidentiality/integrity exposure rather than a denial-of-service vector.

This is a serious, credible priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity attack over HTTP requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact (no availability impact). Oracle's own 'Easily exploitable' phrasing reinforces AC:L. However, several key corroborating signals are MISSING: no EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no evidence of active or widespread exploitation at this time. The lone reference is Oracle's October 2026 Critical Patch Update advisory, consistent with a vendor-coordinated disclosure rather than observed in-the-wild activity. One conflict to flag explicitly: the input Tags include 'Authentication Bypass', yet the CVSS vector specifies PR:L (a low-privileged authenticated attacker is required), which contradicts a true unauthenticated bypass - treat the 'Authentication Bypass' characterization as unverified and defer to the PR:L vector. Net: a high-severity, easily exploitable flaw in an enterprise ERP that warrants prompt patching, but current real-world exploitation probability is unquantified and likely low until a POC emerges.

An attacker who already holds a low-privileged JD Edwards EnterpriseOne application account sends crafted HTTP requests to the Monitoring and Diagnostics (SEC) component. Because the attack is network-based and low-complexity with no user interaction, the attacker can read, create, modify, or delete critical JD Edwards data outside their authorized scope. No public exploit code is identified at time of analysis, so exploitation currently requires original research.