JD Edwards EnterpriseOne EUVD-2026-37385

Attacker must have network reachability to the SMB service (TCP/445) of a JD Edwards EnterpriseOne General Ledger 9.2 server running the E1 Foundation component, and must hold a low-privileged authenticated account (PR:L per the CVSS vector - not unauthenticated). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once those preconditions are met exploitation is direct. Limiting factors: the version must be 9.2 with the affected E1 Foundation, SMB must be reachable from the attacker's position (commonly blocked at perimeters but rarely between internal segments), and the attacker needs valid credentials of at least minimal privilege on the JDE environment.

All signals point to a high-priority issue. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 - network reachable, low complexity, only low privileges required, no user interaction, and a scope change with full CIA impact. Oracle's own characterization of 'easily exploitable' reinforces the low-complexity assessment, and the scope change indicates attackers can pivot beyond the General Ledger module into adjacent JD Edwards components. EPSS and KEV data were not provided in the input, so real-world exploitation probability and active-exploitation status cannot be confirmed; absence of public exploit code does not equal safety given the high CVSS and ERP exposure. The 'Information Disclosure' tag is inconsistent with the C:H/I:H/A:H + S:C vector and Oracle's 'takeover' language - treat the tag as imprecise and rely on the vector, which describes full compromise.

An attacker who has obtained a low-privileged account on the corporate network - for example through phishing a finance clerk or compromising a service account - connects to the JD Edwards EnterpriseOne server over SMB and sends a crafted request to the E1 Foundation that triggers the vulnerability. Because the scope changes, the attacker not only takes over the General Ledger module but also impacts adjacent JD Edwards components, potentially manipulating financial postings, exfiltrating sensitive accounting data, or staging further ERP-wide compromise. No public exploit identified at time of analysis, but the AC:L/PR:L profile means weaponization by a motivated actor is well within reach.