JD Edwards EnterpriseOne EUVD-2026-46986

The attacker must occupy the same physical communication segment as the hardware running JD Edwards EnterpriseOne Tools 9.2.26.3 - this is an adjacent-network-only vulnerability and is not exploitable from the internet or from a remote network without first gaining physical or logical adjacency. The vulnerability is scoped to the Installation Security component, meaning it is specifically relevant during installation or maintenance workflows, not during routine production operation of the ERP platform. A legitimate user (other than the attacker) must actively interact with the system - for example, initiating or proceeding through an installation sequence - at the same time the attack occurs. High attack complexity (AC:H) further requires the attacker to meet specific timing, configuration, or state conditions that cannot be reliably forced; the attacker cannot simply trigger the vulnerability on demand. Exploitation is limited by: insider or physical adjacency required, hard-to-reproduce conditions, concurrent victim interaction needed, and only partial data confidentiality and integrity impact - not full system compromise.

CVSS 3.1 Base Score 3.7 (Low) is a faithful representation of the constrained risk profile. The three compounding barriers - adjacent-only network access (AV:A), high attack complexity (AC:H), and required user interaction (UI:R) - each independently reduce exploitability, and together they make opportunistic or automated attack campaigns essentially infeasible. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified. There is no CISA KEV entry and no known public proof-of-concept code, so no public exploit identified at time of analysis. The impact ceiling is low: only partial data confidentiality and integrity are at stake, with no availability impact. This vulnerability should be treated as a routine, lower-priority patching item addressed during the next scheduled Oracle CPU cycle unless the affected system is deployed in an environment where untrusted hosts share the same network segment as EnterpriseOne infrastructure - in that atypical scenario, network segmentation remediation becomes higher priority.

An attacker with a foothold on the same network segment as the JD Edwards EnterpriseOne Tools host - such as an employee on the same internal LAN or a rogue device on the same VLAN - could attempt to exploit the Installation Security authentication bypass while a legitimate administrator is performing an installation or maintenance action, satisfying the UI:R requirement. Under the specific, difficult-to-reproduce conditions required by AC:H, the attacker could intercept or manipulate the installation interaction to gain partial read or write access to a subset of data accessible to the application. No public proof-of-concept exists, and the adjacent-plus-high-complexity requirement makes opportunistic or scripted exploitation highly unlikely.