JD Edwards EnterpriseOne EUVD-2026-106546

Requires network reachability to the JDENET protocol service of JD Edwards EnterpriseOne Localizations 9.2 (specifically the LATAM localization component) AND valid low-privileged credentials on the EnterpriseOne environment (CVSS PR:L). Oracle describes it as 'easily exploitable' with low attack complexity (AC:L) and no user interaction (UI:N). Limiting factors: the attacker must be authenticated at a low privilege level - this is NOT an unauthenticated flaw - and exploitation is confined to environments running the affected LATAM localization module at version 9.2 with the JDENET listener exposed to the attacker; impact is partial (subset read access and partial DOS only, no integrity or full availability loss).

This is a moderate-severity issue (CVSS 3.1 base 5.4) that reads as a genuine but non-urgent patch priority rather than a critical fire-drill. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, but the impact is deliberately bounded: partial confidentiality loss (C:L - read access to a subset of data) and partial availability loss (A:L - partial DOS), with no integrity impact (I:N) and no scope change (S:U). No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis. These signals are consistent with one another - a mid-tier authenticated flaw in an enterprise ERP module with no evidence of exploitation. The PR:L requirement is the key risk limiter: an attacker must already hold valid low-privilege credentials on the JD Edwards EnterpriseOne environment, which materially reduces the external attack surface versus an unauthenticated flaw. No SSVC decision data was provided in the input, so automatable/exploitation status under that framework cannot be stated. No data directly conflicts here; the main gap is the absence of EPSS and any SSVC/CWE classification, so exploitation probability cannot be quantified.

A low-privileged user (or an attacker who has phished or otherwise obtained low-level JD Edwards credentials) sends a crafted request over the JDENET protocol to the EnterpriseOne Localizations LATAM component on version 9.2. The malformed request lets them read a subset of localization data they should not see and/or disrupt the service to cause a partial denial of service. No public exploit code was referenced, and no user interaction is required (UI:N).