The vulnerability in Oracle JD Edwards EnterpriseOne Operational Sourcing allows a low‑privileged attacker who can reach the system over SMTP to read critical data. Successful exploitation results in unauthorized access to data accessible through the application. The CVSS vector indicates severe confidentiality impact but no integrity or availability effects.

Oracle Corporation’s JD Edwards EnterpriseOne Operational Sourcing, version 9.2, is the only affected release.

The CVSS Base Score of 6.5 places the flaw in the medium range, and no EPSS score is currently available, reducing the certainty of exploitation prevalence. The attack requires only network access to the SMTP interface; once an attacker supplies the crafted message, they can retrieve data without further privileges. The vulnerability is listed in the vendor’s October 2026 patch advisory and is not indexed in the CISA KEV catalog.