JD Edwards EnterpriseOne EUVD-2026-106535

Exploitation requires luring a human victim (a person other than the attacker, per the description) into interacting with attacker-supplied content via HTTP against the JD Edwards EnterpriseOne Tools web interface - the UI:R requirement is the primary limiting factor, meaning this cannot be exploited automatically or without a willing/tricked user. No attacker authentication is needed (PR:N, unauthenticated). Affected supported versions are 9.2.0.0 through 9.2.26.5. The scope change means successful exploitation can reach additional products beyond JD Edwards Tools itself. Impact is bounded to low confidentiality (read of a subset of data) and low integrity (unauthorized update/insert/delete to some data), with no availability impact.

This is a medium-severity (CVSS 3.1 base 6.1) issue in Oracle JD Edwards EnterpriseOne Tools that reads more like a priority-to-patch-on-schedule item than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring no privileges, but critically requires user interaction (UI:R) from a victim other than the attacker, and produces only low confidentiality and low integrity impact with no availability impact - a signature consistent with a reflected cross-site-scripting / content-injection class flaw. The scope change (S:C) is the one elevating factor: attacks 'may significantly impact additional products,' which is why Oracle rates it 6.1 rather than lower. On exploitation signals: no EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC-style framing: exploitation is 'none' (no KEV/POC), it is NOT automatable (requires a human victim to interact), and technical impact is partial, so the realistic decision is routine remediation, not immediate crisis response. Note a metadata conflict: the input tag 'Authentication Bypass' is inconsistent with both the description (which describes no authentication bypass) and the CVSS vector (which describes victim-interaction, low-partial-impact, scope-change behavior typical of XSS, not auth bypass) - treat the tag as unreliable and verify the true weakness via the Oracle CPU advisory.

An unauthenticated attacker crafts a malicious HTTP link or request targeting the JD Edwards EnterpriseOne Tools web interface and lures a legitimate user (for example an authenticated operator) into clicking it. When the victim interacts, injected content executes in their session context, allowing limited unauthorized read of some JD Edwards data and limited unauthorized update/insert/delete, with the scope change potentially carrying impact into additional connected products. No public exploit code is referenced at time of analysis.