JD Edwards EnterpriseOne EUVD-2026-106566

Exploitation requires the attacker to already possess a valid, low-privileged logon to the server infrastructure where JD Edwards EnterpriseOne Tools executes (local vector, AV:L/PR:L) and targets the Installation Security component of affected versions 9.2.0.0 through 9.2.26.5. No user interaction is needed (UI:N) and complexity is low (AC:L). The key limiting factors are the need for prior authenticated local/host access - this is not remotely exploitable over the network and not usable by fully unauthenticated attackers - which confines realistic risk to insiders or attackers who have already compromised an account on the host; impact is limited to confidentiality (data disclosure), with no integrity or availability effect, though the scope change can expose data in additional co-located products.

This is a moderate-priority issue, not a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 base score of 6.5 (Medium) is driven by a local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), a scope change (S:C), and confidentiality-only impact (C:H/I:N/A:N) - meaning an authenticated low-privileged user on the host where JD Edwards EnterpriseOne Tools runs can read sensitive data and, because of the scope change, potentially access data belonging to additional products beyond EnterpriseOne itself. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The requirement for prior authenticated local access (PR:L, AV:L) substantially limits real-world exposure to insiders or attackers who have already gained a foothold, which contrasts with the 'Authentication Bypass' tag in the metadata - that tag is not supported by the CVSS vector (which explicitly requires privileges) or the description (which describes unauthorized data access by an already-logged-in low-privileged user, not a bypass of authentication); verify the tag against Oracle's advisory. The absence of integrity and availability impact further bounds the damage to data disclosure.

A low-privileged user with a valid local logon to the server infrastructure hosting JD Edwards EnterpriseOne Tools abuses a flaw in the Installation Security component to read confidential data they should not be able to access. Because the vulnerability causes a scope change, the disclosed data can extend to other products co-located with or dependent on EnterpriseOne Tools. No public exploit code is available at time of analysis, and exploitation requires the attacker to already hold an authenticated account on the host.