JD Edwards EnterpriseOne EUVD-2026-61349

Exploitation requires a low-privileged account on the JD Edwards EnterpriseOne system, as confirmed by PR:L in the CVSS 3.1 vector - unauthenticated exploitation is not supported by available data. The attacker must have network-level HTTP access to the target system. No user interaction beyond the attacker's own crafted request is required. The affected component is 'Installation Security,' suggesting the exploitable interface may be accessible via standard JD Edwards HTTP service endpoints rather than requiring access to administrative consoles. Limiting factors include: a valid low-privilege JD Edwards account is mandatory; deployments with no HTTP network path or that are fully airgapped have significantly reduced exposure; instances patched beyond 9.2.26.4 per the Oracle CPU August 2026 advisory are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8, reflecting a straightforward network exploit requiring minimal privilege. Oracle's own classification of 'easily exploitable' typically corresponds to low attack complexity and a reliable, repeatable attack path. No EPSS score was included in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed active exploitation. However, the combination of network reachability, low privilege bar, no user interaction, and full system takeover potential makes this a high-priority patch target for any organization running JD Edwards EnterpriseOne in Internet-accessible or internally shared network segments. Defenders should note that the intelligence tag 'Information Disclosure' conflicts with the CVSS C:H/I:H/A:H outcome and must not be used to downgrade the severity posture.

An attacker holding a low-privileged JD Edwards account - such as a contractor, read-only user, or the result of a compromised credential - sends a crafted HTTP request to the Installation Security component of the EnterpriseOne Tools interface. The vulnerability triggers without any additional user interaction, and the attacker achieves full control of the JD Edwards EnterpriseOne Tools environment, enabling access to ERP data, modification of business records, or operational disruption. No public proof-of-concept code has been identified at time of analysis.