JD Edwards EnterpriseOne EUVD-2026-37227

Exploitation requires (1) network HTTP reachability to the Accounts Payable component of an Oracle JD Edwards EnterpriseOne 9.2 deployment and (2) any valid low-privileged EnterpriseOne credential (PR:L) - no admin role and no user interaction are needed. Limiting factors: the attacker must be authenticated against EnterpriseOne (rules out anonymous internet scans against properly perimeter-isolated deployments), the affected version is narrowly 9.2, and only the Accounts Payable module is in the direct attack surface (though scope change extends impact). Organizations that expose EnterpriseOne only on internal networks and tightly control account provisioning materially raise the bar.

Real-world risk is high but not yet evidence-backed by exploitation telemetry. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates trivially exploitable, network-reachable HTTP attack requiring only a low-privileged account, with cross-product blast radius and full CIA impact - the rare combination that justifies the 9.9 score. EPSS, KEV, and POC signals are absent from the provided intelligence, so there is no confirmation of active exploitation or weaponization; this looks like a freshly disclosed Oracle CPU finding rather than an in-the-wild campaign. The PR:L requirement is the main brake on opportunistic mass exploitation - any organization that issues EnterpriseOne accounts liberally (consultants, AP clerks, vendor portals) should treat it as priority-one because credential reuse or a single phished AP user is enough to pivot.

An attacker who has obtained or been issued any low-privileged EnterpriseOne account - for example a compromised AP clerk, an over-provisioned vendor portal user, or a phished consultant - sends a crafted HTTP request to the Accounts Payable component. The scope change allows the attack to reach beyond Accounts Payable into adjacent EnterpriseOne services, ending in full takeover of the AP module and likely a foothold into broader financial data and processes. No public exploit identified at time of analysis, but the AC:L/UI:N profile means weaponization would be straightforward once technical details surface.