Vulnerability in the JD Edwards EnterpriseOne Orchestrator allows an unauthenticated attacker who can reach the physical communication segment attached to the hardware where the orchestrator runs to compromise the system. Successful exploitation can result in unauthorized creation, deletion or modification of critical data, as well as unauthorized access to all data the orchestrator manages. This threat impacts confidentiality and integrity, and can alter system state without requiring any user privileges.

Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5 are affected. The flaw resides in the E1 IOT Orchestrator Security component. Only deployments of those specific versions of the orchestrator are vulnerable.

The weakness carries a CVSS 3.1 base score of 6.8, indicating moderate severity. The exploitation vector is Adjacent Local (attackers must physically reach the communication segment), which limits the attack surface but still allows a local threat actor. EPSS is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. The combination of a moderate CVSS score and the requirement for physical proximity yields a situation that should be addressed promptly, particularly in environments where the orchestrator holds sensitive or mission‑critical data.