CVE-2026-91281 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform because it allows for unauthorized access and manipulation of data without requiring prior authentication. The vulnerability is classified as easily exploitable, indicating that the technical barriers an attacker must overcome are minimal once they have network connectivity via HTTP. However, the exploitation process includes a specific requirement for human interaction from a user other than the initial attacker. This characteristic suggests that the attack vector likely involves social engineering or phishing tactics where a legitimate user is tricked into performing an action that triggers the vulnerability, such as clicking on a malicious link or opening a crafted document within the application environment.
From a technical perspective, this flaw enables unauthenticated attackers to compromise the integrity and confidentiality of data accessible through JD Edwards EnterpriseOne Tools. The operational impact includes unauthorized updates, inserts, and deletes against certain datasets managed by the system. This means an attacker could alter critical business records, delete essential transactional data, or inject false information into the database, thereby disrupting normal business operations and potentially causing financial loss or reputational damage. Furthermore, the vulnerability grants unauthorized read access to a subset of accessible data, allowing attackers to exfiltrate sensitive corporate information such as customer details, employee records, or proprietary business metrics. The scope change noted in the advisory indicates that while the technical flaw is located within JD Edwards EnterpriseOne Tools, the consequences can cascade and significantly impact additional products integrated with or dependent on this system, amplifying the overall risk profile for the organization.
In terms of industry standard classifications, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials if authentication bypass involves static keys, but more accurately reflects CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-352: Cross-Site Request Forgery (CSRF) or similar web-based injection flaws given the HTTP vector and human interaction requirement. The attack pattern is consistent with MITRE ATT&CK technique T1566.001: Phishing: Spearphishing Attachment, where an attacker sends a malicious payload to induce user action, followed by T1078: Valid Accounts if the exploited session allows further lateral movement, or T1213: Data from Information Repositories for the data exfiltration aspect. The CVSS 3.1 base score of 6.1 reflects moderate severity due to the combination of network accessibility and low attack complexity balanced against the requirement for user interaction and limited availability impact.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle JD Edwards that address vulnerabilities in the Enterprise Infrastructure SEC component. Since exploitation relies on human interaction, robust security awareness training is essential to educate users about recognizing suspicious links or requests within the application interface. Implementing strict access controls and ensuring that only authorized personnel have administrative privileges can limit the potential damage if a user account is compromised. Additionally, deploying web application firewalls with behavioral analysis capabilities may help detect and block anomalous HTTP requests associated with this exploitation attempt. Regular vulnerability scanning and penetration testing should be conducted to identify similar weaknesses in integrated systems before they can be leveraged by malicious actors.