JD Edwards Orchestrator EUVD-2026-61347

Exploitation requires the attacker to hold a valid, low-privileged account within the JD Edwards EnterpriseOne system (consistent with CVSS PR:L), and the Orchestrator component must be deployed and network-accessible over HTTP - which is its standard operational mode. No user interaction is required (UI:N) and no special non-default configuration is specified beyond the Orchestrator itself being deployed. The attack is limited to users who can authenticate to JD Edwards at any privilege level; completely unauthenticated external attackers without any valid account cannot exploit this vulnerability. The scope does not change (S:U), so impact is bounded to the Orchestrator and its accessible data rather than extending to the underlying OS or other systems. Availability is not impacted (A:N), meaning denial-of-service is not part of the attack surface.

The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity flaw: network-reachable, low complexity, low privilege requirement, no user interaction, with dual high-impact confidentiality and integrity outcomes. The absence of an availability impact vector is notable and slightly depresses the score, but the dual C:H/I:H rating still places this squarely in the urgent-remediation tier. No EPSS score is available in the provided data, limiting probabilistic exploitation forecasting, and the vulnerability is not currently listed in the CISA KEV catalog - meaning active exploitation has not been officially confirmed. However, even a mid-sized municipal IT team in boleslawiec running JD Edwards for procurement or asset management should treat this as urgent given how broadly the 9.2 branch is deployed and how accessible the Orchestrator API typically is within enterprise networks. The 'Authentication Bypass' tag is the sharpest risk signal here: if a valid low-privileged user account - such as a read-only reporting account or a service account - is sufficient to bypass security controls and gain full read/write access to Orchestrator data, the privilege escalation surface is very wide in environments with many users. No POC code is publicly known at this time, which marginally reduces near-term mass-exploitation risk, but Oracle ERP vulnerabilities are targeted by financially motivated threat actors.

An attacker with any valid low-privileged JD Edwards account - such as a contractor, a read-only reporting user, or a compromised service account - sends crafted HTTP requests to the EnterpriseOne Orchestrator REST API, bypassing the E1 IOT Orchestrator Security component's access controls. By exploiting this bypass, the attacker reads or exfiltrates sensitive ERP data (financials, procurement records, supply chain data) and potentially modifies or deletes critical Orchestrator-accessible records. No public proof-of-concept is known, but the low attack complexity (AC:L) suggests exploitation does not require sophisticated tooling once the bypass mechanism is understood.