JD Edwards EnterpriseOne Tools EUVD-2026-106534

Exploitation requires reaching the JD Edwards EnterpriseOne Tools Web Runtime SEC component over HTTP AND human interaction from a victim other than the attacker (UI:R) - typically an authenticated JD Edwards user who must open or interact with attacker-crafted content for the injected payload to execute in their browser. Limiting factors: the dependence on social engineering/victim interaction means it is not self-propagating or mass-automatable; impact is confined to a subset of accessible data (partial read plus limited update/insert/delete) with no availability impact; and only versions 9.2.0.0 through 9.2.26.5 are affected. No privileges are required of the attacker (PR:N), so the web front end need not be authenticated to the attacker, but a target user session is the practical delivery vehicle.

This is a moderate-severity issue (CVSS 3.1 6.1) whose signals point to a browser-targeted injection flaw (almost certainly stored/reflected cross-site scripting) rather than a high-priority server compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network reachability over HTTP with low complexity and no privileges, but the mandatory UI:R and scope-change-with-limited-C/I-and-no-A profile is the canonical web-injection pattern - the 'compromise' is of the victim's session/other products, not direct code execution. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' NOTE A CONFLICT: the input Tag 'Authentication Bypass' is inconsistent with the vector and description, which describe partial C/I impact via user interaction, not an auth-bypass - treat the tag as unreliable. Overall this is a real-but-not-urgent patch-in-normal-cycle item: low per-record impact, unauthenticated reachability offset by required human interaction, and no current exploitation signal.

An unauthenticated attacker crafts a malicious HTTP request/link or payload handled by the JD Edwards EnterpriseOne Tools Web Runtime SEC component and lures an authenticated JD Edwards user into triggering it. When the victim loads the crafted content, injected script runs in their browser context, letting the attacker read a subset of accessible data and perform limited unauthorized update/insert/delete actions, with impact spilling into additional products (scope change). No public exploit code is identified at time of analysis.