EnterpriseOne Orchestrator EUVD-2026-106539

Requires an attacker to already possess a low-privilege authenticated account on JD Edwards EnterpriseOne Orchestrator (PR:L) with network HTTP reachability to the Orchestrator's E1 IOT Orchestrator Security component; versions 9.2.0.0 through 9.2.26.5 are affected. No user interaction and no special non-default configuration is indicated (AC:L/UI:N), but the mandatory valid-credential requirement is the primary limiting factor, confining exploitation to insiders or attackers who have first obtained Orchestrator login access. Impact is limited to confidentiality (data disclosure); integrity and availability are not affected.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality impact but zero integrity or availability impact - i.e. a read/disclosure flaw, not code execution or data tampering. No EPSS score was supplied, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept was identified, so there is currently no public exploit identified at time of analysis. The 'low privileged attacker' wording confirms that a valid (if minimal) authenticated session is a precondition, which meaningfully lowers real-world risk versus an unauthenticated flaw. Note a data conflict: the input Tags include 'Authentication Bypass', but the CVSS vector specifies PR:L (privileges required) - these are contradictory, since a true auth bypass would normally imply PR:N; the vector and Oracle's 'low privileged attacker' description should be treated as authoritative over the tag. Overall this warrants prompt patching in the next Oracle CPU maintenance cycle but does not represent confirmed active exploitation.

A user who already holds a low-privilege JD Edwards EnterpriseOne account (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Orchestrator's E1 IOT Orchestrator Security component over the network, with no user interaction required. Because the flaw grants high confidentiality impact, the attacker reads critical business data accessible to the Orchestrator beyond their intended authorization. No public exploit code is known, so exploitation currently requires original research.