A vulnerability in the JD Edwards EnterpriseOne Orchestrator component called E1 IOT Orchestrator Security allows an unauthenticated attacker with network access through HTTP to fully compromise the orchestrator. The flaw can be easily exploited and leads to complete takeover, impacting confidentiality, integrity, and availability of the system. The static nature of the attack vector and lack of required credentials make it a severe threat scenario.

All Oracle JD Edwards EnterpriseOne Orchestrator installations built on versions 9.2.0.0 through 9.2.26.5 are affected. The vulnerability’s scope change indicates that other products beyond the orchestrator may also be impacted if they are integrated or connected in the same deployment.

The CVSS 3.1 base score of 10.0 demonstrates that this is a critical vulnerability. The EPSS score is not available, but the ease of exploitation and network reachability elevate the risk. This vulnerability is not yet listed in the CISA KEV catalog, but its high impact and lack of authentication requirements suggest that it is a priority for immediate mitigation. The most likely attack vector is direct unauthenticated HTTP traffic to the orchestration endpoint, which can be leveraged by an attacker to execute arbitrary code or commands on the orchestrator server.