CVE-2026-91265 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 to 9.2.26.5. This security flaw represents a critical weakness in the application's authentication and access control mechanisms, allowing for unauthorized interaction with sensitive system resources. The nature of this vulnerability is particularly severe because it does not require any form of user interaction or prior authentication credentials. An attacker can initiate an exploit simply by establishing network connectivity to the target system via HTTP, leveraging low complexity attack vectors to gain foothold within the environment. This characteristic significantly lowers the barrier for entry, making the vulnerability highly attractive to automated scanning tools and opportunistic attackers who seek to compromise systems with minimal effort or specialized knowledge of internal configurations.
From a technical perspective, the flaw enables an unauthenticated attacker to perform unauthorized creation, deletion, or modification operations on critical data stored within the JD Edwards EnterpriseOne Tools database. The impact extends beyond mere data manipulation; it also grants unauthorized access to sensitive information that should be restricted to authenticated users with appropriate privileges. This dual capability to alter and read data indicates a fundamental failure in enforcing security boundaries between untrusted network inputs and protected backend resources. In industry-standard classification terms, this vulnerability aligns closely with CWE-287, which describes Improper Authentication, as well as CWE-922, indicating Insecure Storage of Sensitive Information if the access leads to data exposure. The ability to modify critical data further implicates weaknesses in integrity controls, potentially mapping to CWE-354, Improper Validation of Integrity Check Value, depending on how the application processes incoming requests without verifying their legitimacy or source authority.
The operational impact of this vulnerability is substantial, posing a direct threat to the confidentiality and integrity of enterprise operations managed through JD Edwards EnterpriseOne Tools. With a CVSS 3.1 Base Score of 9.1, classified as Critical severity, the potential for damage is high. Successful exploitation allows an attacker to exfiltrate sensitive business data, leading to significant breaches of privacy and competitive advantage loss. Furthermore, the ability to delete or modify critical records can disrupt business continuity, cause financial discrepancies, and corrupt operational workflows that rely on accurate transactional data. This level of access effectively compromises the core functionality of the ERP system, as attackers could manipulate inventory levels, alter financial ledgers, or remove audit trails necessary for compliance reporting. The lack of availability impact in the CVSS vector suggests that while data integrity is severely compromised, immediate service disruption may not be a primary outcome, though persistent modification of configuration files could lead to denial-of-service conditions over time.
In terms of threat modeling and adversary behavior, this vulnerability facilitates actions consistent with ATT&CK technique T1078, Valid Accounts, although in this case, the attacker operates without valid credentials by bypassing authentication entirely. It also relates to T1530, Data from Cloud Storage Object, if sensitive data is accessed remotely, and potentially T1496, Resource Hijacking or T1489, Service Stop, depending on how the deletion of critical data affects system stability. The ease of exploitation via HTTP means that this vulnerability can be leveraged in broad-scale attacks targeting organizations running affected versions without needing to conduct complex reconnaissance or social engineering campaigns. Attackers can script automated exploits to scan large networks for vulnerable instances and compromise them rapidly, leading to widespread breaches across multiple enterprises simultaneously if patching is delayed.
To mitigate the risks associated with this vulnerability, immediate action is required from system administrators and security teams responsible for maintaining JD Edwards EnterpriseOne Tools environments. The primary remediation step involves applying the latest available patches or updates provided by Oracle that address the specific flaw in the Enterprise Infrastructure SEC component. Organizations must verify their current version against the affected range of 9.2.0.0 to 9.2.26.5 and prioritize upgrading systems within this scope as soon as possible. In addition to patching, implementing network-level controls such as Web Application Firewalls can provide a layer of defense by filtering malicious HTTP requests that attempt to exploit the authentication bypass. Restricting direct internet access to JD Edwards servers and ensuring they are only accessible through secure, authenticated channels further reduces the attack surface. Regular security audits and penetration testing should be conducted to identify any residual weaknesses in access control logic, ensuring that future updates do not introduce similar flaws. Continuous monitoring of system logs for unusual activity patterns indicative of unauthorized data access or modification is also recommended to detect potential exploitation attempts early.