JD Edwards EnterpriseOne EUVD-2026-106638

Exploitation requires an authenticated low-privilege JD Edwards EnterpriseOne Tools account (CVSS PR:L) and network reachability to the JDENET communication service that fronts the Web Runtime SEC component; only versions 9.2.0.0 through 9.2.26.5 are affected. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once valid low-privilege credentials and JDENET access exist, exploitation is straightforward. The limiting factors defenders should weigh are the mandatory prior authentication and the exposure of the JDENET port - deployments that restrict JDENET to trusted internal networks and tightly control ERP account provisioning substantially reduce realistic risk.

This is a moderate-priority confidentiality vulnerability, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold a valid low-privilege JD Edwards EnterpriseOne account - this is the single largest mitigating factor and keeps the score at Medium rather than Critical. Impact is confined to confidentiality (C:H), with no integrity or availability effect, so the worst case is disclosure of sensitive ERP data rather than data tampering or outage. No EPSS score is provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. SSVC-style framing: exploitation status is none/unobserved, technical impact is partial (confidentiality-only), and automatability is uncertain because authentication is required. Signals are internally consistent - the 'network vector but authenticated' profile matches Oracle's standard JDENET-exposed ERP flaw pattern - but note one metadata conflict: the input Tag labels this 'Authentication Bypass' while the CVSS vector explicitly requires privileges (PR:L), so the tag appears inaccurate and should not be used to justify unauthenticated-exploitation assumptions. Treat this as a scheduled Oracle CPU patch item prioritized for internet-exposed or multi-tenant JD Edwards deployments, not a drop-everything event.

An attacker who has obtained or been granted a low-privilege JD Edwards EnterpriseOne user account sends a crafted request over the network via the JDENET communication service to the Web Runtime SEC component. Because attack complexity is low, the request reliably abuses the flaw to read critical business data the account should not be able to access, up to complete access to all JD Edwards EnterpriseOne Tools data. No public proof-of-concept is referenced in the available data.