JD Edwards EnterpriseOne EUVD-2026-37230

The attacker must have network reachability to a JD Edwards EnterpriseOne 9.2 server speaking the JDENET protocol (the proprietary middleware port exposed by the enterprise/HTML server) and must hold a valid low-privileged JD Edwards account (PR:L) - fully anonymous exploitation is not in scope per the CVSS vector. No user interaction is required (UI:N) and attack complexity is Low (AC:L), so once those two prerequisites are met exploitation is straightforward against the default Project Costing / Job Costing component on version 9.2. Limiting factors: deployments that firewall JDENET to internal application tiers, that do not expose Project Costing to general business users, or that have already applied the June 2026 CPU are not exploitable; only the 9.2 supported branch is named, and availability is unaffected so the attack is data-oriented rather than disruptive.

The CVSS 3.1 base score of 9.6 is driven by network attack vector, low complexity, only low privileges required, no user interaction, and a scope change that elevates confidentiality and integrity impact to High across additional products; availability is unaffected (A:N), so this is a data-integrity and data-disclosure issue rather than a denial-of-service one. Real-world exposure depends on whether the JDENET listener is reachable from untrusted networks - in well-segmented ERP deployments JDENET is restricted to internal application tiers, which materially lowers practical risk versus the raw 9.6. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the input, so exploitation is not known to be active. Given that PR:L only requires any valid JD Edwards user (including low-trust accounts such as self-service or read-only operators) and that S:C means the blast radius extends beyond Project Costing, this should still be treated as a high-priority Oracle CPU patch for any organization running EnterpriseOne 9.2.

A user with a low-privileged JD Edwards account (for example, a self-service project employee or contractor) authenticates to the EnterpriseOne environment and sends a crafted JDENET request to the Job Costing component, which fails to enforce authorization and lets the attacker read or alter cost, budget, and billing records - and, due to the scope change, data in adjacent JD Edwards modules - manipulating financial figures or exfiltrating sensitive project data. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make weaponisation by a malicious insider or a compromised low-trust account straightforward once the JDENET endpoint is reachable.