JD Edwards EnterpriseOne EUVD-2026-46875

Exploitation requires network reachability to the JDENET protocol listener of the JD Edwards EnterpriseOne CRM Foundation 9.2 server AND at least low-level privileges (PR:L) - i.e., the attacker must be an authenticated/low-privileged participant, not an anonymous internet user. Oracle explicitly rates this 'difficult to exploit' with high attack complexity (AC:H), meaning success depends on additional conditions outside the attacker's direct control (timing, specific server state, or configuration) rather than a single deterministic request. Limiting factors that reduce real-world risk: the required standing privilege, the high-complexity conditions, the reliance on JDENET exposure (commonly segmented on internal application tiers rather than internet-facing), and the fact that only version 9.2 is named. No user interaction is required (UI:N).

The signals are mixed and lean toward a moderate, not emergency, priority. The CVSS 3.1 base score is 7.5 (High), but the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H shows two meaningful brakes: high attack complexity (AC:H) and a requirement for at least low privileges (PR:L), meaning the attacker must already have some valid access or foothold and win non-trivial conditions. There is no EPSS score provided, no POC, and no CISA KEV listing, so there is no evidence of active or automated exploitation. A notable conflict exists between the intelligence tags, which label this 'Information Disclosure', and the Oracle description, which explicitly states 'takeover' with full C/I/A impact - the description and CVSS vector should be treated as authoritative, and the tag appears to be an imprecise categorization. Net: a credible high-severity flaw for internet- or partner-exposed JDENET servers, but the PR:L and AC:H requirements make widespread opportunistic exploitation unlikely, favoring patch prioritization within a normal CPU cycle rather than out-of-band emergency response.

An attacker who holds a low-privileged EnterpriseOne account (or has pivoted onto a host that can reach the JDENET listener) sends specially crafted JDENET messages to the CRM Foundation server and, after satisfying the non-trivial (AC:H) conditions, escalates to full control of the component. No user interaction is required, and success results in read/write access and disruption of CRM Foundation data and services. No public proof-of-concept is known at time of analysis, which raises the practical bar for opportunistic attackers.