CVE-2026-91267 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Interoperability SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is classified as a critical issue due to its high severity score and the ease with which it can be exploited by an unauthenticated attacker. The vulnerability allows for remote code execution or unauthorized data access via SOAP interfaces, leveraging network connectivity without requiring any form of user authentication or interaction. This characteristic significantly lowers the barrier to entry for malicious actors, enabling them to target systems over standard networks such as the internet or internal corporate LANs where SOAP services are exposed.
From a technical perspective, the flaw likely stems from insufficient validation or improper handling of input data within the Interoperability SEC module when processing SOAP requests. The absence of proper authentication checks combined with weak access control mechanisms permits an attacker to bypass security boundaries and execute commands or retrieve sensitive information directly through web service calls. This type of vulnerability is commonly associated with CWE-287, which describes Improper Authentication, and potentially CWE-918, reflecting Server-Side Request Forgery if the component processes external URLs without adequate restrictions. The exploitation does not require user interface interaction, aligning with ATT&CK technique T1190, Exploit Public-Facing Application, as it targets a service exposed to network traffic rather than relying on social engineering or local privilege escalation paths.
The operational impact of this vulnerability is severe and extends beyond the immediate JD Edwards EnterpriseOne Tools environment due to scope changes inherent in interconnected enterprise systems. Successful exploitation can lead to unauthorized access to critical business data, including financial records, customer information, and proprietary intellectual property stored within the ERP system. The CVSS 3.1 base score of 8.6 reflects a high impact on confidentiality, indicating that attackers could potentially exfiltrate large volumes of sensitive data or gain complete administrative control over accessible JD Edwards resources. This level of compromise can result in significant financial loss, regulatory penalties under frameworks such as GDPR or HIPAA if personal health or payment information is involved, and long-term reputational damage for the affected organization.
Mitigation strategies must prioritize immediate remediation through patching to the latest supported version that addresses this specific flaw within the Interoperability SEC component. Organizations should verify their current build level against Oracle’s security bulletins to ensure they are not running vulnerable versions between 9.2.0.0 and 9.2.26.5. In addition to applying vendor-provided patches, it is crucial to implement network-level controls such as firewalls or web application firewalls that restrict SOAP traffic to trusted IP addresses only. Enforcing strict authentication policies for all API endpoints and disabling unnecessary services can further reduce the attack surface. Regular vulnerability scanning and penetration testing should be conducted to identify similar misconfigurations in other enterprise applications, ensuring a holistic approach to securing critical infrastructure against unauthenticated remote exploitation attempts.