EnterpriseOne Orchestrator EUVD-2026-106640

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Orchestrator executes (CVSS AV:A, Adjacent) - it is NOT exploitable over the public internet or from arbitrary remote networks. No credentials (PR:N) and no user interaction (UI:N) are needed, but Attack Complexity is High (AC:H), meaning the attacker must satisfy conditions outside their control such as specific timing, race, or application state. Affected deployments are JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5. The key limiting factors defenders can rely on are network adjacency (segment the Orchestrator onto an isolated/trusted VLAN) and the high-complexity precondition, both of which meaningfully constrain realistic exploitation.

This is a moderate-priority issue that scores CVSS 3.1 6.8 (Medium) despite high Confidentiality and Integrity impact, primarily because of two limiting metrics in Oracle's vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N): the attack vector is Adjacent (AV:A), requiring the attacker to be on the physical communication segment attached to the host running the Orchestrator, and Attack Complexity is High (AC:H), implying conditions outside the attacker's control (e.g., timing, specific state) must be met. These constraints substantially reduce real-world exploitability relative to the serious C:H/I:H impact. No EPSS score, SSVC decision, or CISA KEV entry was provided in the input, and no public exploit was referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no signal of mass or automatable exploitation; the adjacency requirement inherently makes any attack targeted rather than widespread. The 'Authentication Bypass' tag is consistent with PR:N (unauthenticated) but is not independently corroborated by the terse description, which describes unauthenticated adjacent compromise rather than an explicit auth-bypass mechanism - treat that characterization with caution. Overall: a genuine high-impact data compromise flaw, but the Adjacent + High-complexity + unauthenticated profile places it as a patch-in-normal-cycle item rather than an emergency, absent any exploitation evidence.

An attacker who has already gained a foothold on the same local/physical network segment as a JD Edwards EnterpriseOne Orchestrator host (e.g., a malicious insider or a pivot from another compromised device on the LAN/VLAN) manipulates traffic to the Orchestrator and, after meeting specific timing or state conditions implied by the High attack complexity, compromises it without credentials. Success yields read and write access to all data accessible to the Orchestrator, enabling theft or tampering of critical ERP data. No public exploit code was identified at time of analysis.