CVE-2026-91280 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for critical business operations. The core technical issue involves an authentication bypass mechanism that allows unauthenticated actors to interact with the application via HTTP. Unlike many vulnerabilities that require complex exploitation chains or specific user privileges, this defect permits remote attackers who have network access to initiate malicious requests without providing valid credentials. This lack of proper access control enforcement at the web runtime layer fundamentally undermines the integrity of the authentication process, creating a direct pathway for unauthorized interaction with system resources.
The operational impact of this vulnerability is characterized by its reliance on human interaction for successful exploitation. While an attacker can technically send exploit payloads over the network without prior authentication, they must induce a legitimate user to perform specific actions, such as clicking a malicious link or interacting with a compromised interface element. This social engineering aspect aligns with ATT&CK techniques involving诱骗 users into executing unintended operations. Once this interaction occurs, the scope of impact expands beyond the immediate JD Edwards environment due to potential lateral movement or data exfiltration that affects additional products within the broader IT ecosystem. The primary consequences involve unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete capabilities for other portions of the database. This dual impact on both confidentiality and integrity means sensitive business information can be stolen while critical records can be corrupted or destroyed, leading to significant operational disruption and potential regulatory compliance failures.
From a classification perspective, this vulnerability is best understood through standard security frameworks. It maps closely to CWE-287, which describes Improper Authentication, as the system fails to verify identity before allowing sensitive operations. Furthermore, the ability of an unauthenticated actor to modify data points toward CWE-269, indicating Improper Privilege Management where lower-level or anonymous entities are granted elevated permissions. The requirement for user interaction places it within the realm of UI-based attacks, often associated with Cross-Site Request Forgery patterns if the exploitation involves tricking a logged-in administrator into performing actions on their behalf. The CVSS 3.1 base score of 6.1 reflects these moderate-to-high severity characteristics, driven by network accessibility and low attack complexity but tempered slightly by the need for user interaction and limited availability impact.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. Until patching is complete, implementing strict network segmentation to restrict HTTP access from untrusted zones can reduce the attack surface. Additionally, deploying web application firewalls with rules designed to detect and block anomalous request patterns associated with authentication bypasses may provide a temporary layer of defense. Security teams should also enforce multi-factor authentication for all administrative interfaces and monitor logs for unusual activity indicative of unauthorized data modifications or access attempts. Regular audits of user permissions and strict adherence to the principle of least privilege will further harden the environment against exploitation of this specific flaw.