CVE-2026-91283 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools, affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is classified as an easily exploitable issue that permits unauthenticated attackers to compromise the integrity and confidentiality of the application environment. The attack vector requires network access via HTTP, indicating that the vulnerability can be triggered remotely over standard web protocols without requiring direct physical or local system access. Despite the ease of exploitation from a technical standpoint, the successful execution of this exploit is contingent upon human interaction. Specifically, it necessitates action by a user other than the attacker, such as clicking on a malicious link or visiting a compromised webpage that triggers the vulnerable code path within the JD Edwards environment. This dependency on social engineering elements significantly influences the overall risk profile and exploitation complexity.
From a technical perspective, this vulnerability is primarily characterized by its impact on data confidentiality rather than system integrity or availability. The core flaw allows an unauthorized party to read a subset of accessible data within the JD Edwards EnterpriseOne Tools application. While the attacker cannot modify existing records or disrupt service operations directly through this specific vector, the ability to extract sensitive information represents a significant breach of privacy and potentially regulatory compliance requirements. The CVSS 3.1 base score is calculated at 4.3, which places it in the medium severity range. This scoring reflects the combination of network accessibility and low attack complexity against the requirement for user interaction and the limited scope of impact restricted to confidentiality. The specific vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms that while privileges are not required, the presence of a human element acts as a partial mitigating factor against automated mass exploitation attempts.
In terms of industry standard classifications, this vulnerability aligns with CWE-200, which denotes Exposure of Sensitive Information to an Unauthorized Actor. The requirement for user interaction suggests potential alignment with CWE-79, commonly known as Cross-Site Scripting (XSS), or potentially CWE-614 if the issue involves session management weaknesses that allow unauthorized data retrieval after initial authentication bypasses. From a tactical standpoint within the MITRE ATT&CK framework, this behavior corresponds to techniques involving Collection and Exfiltration over Application Layer Protocols. Attackers leveraging this flaw would likely engage in reconnaissance followed by targeted social engineering campaigns to induce victims into triggering the exploit, thereby facilitating unauthorized data access without leaving immediate traces of brute-force or automated scanning activity that might trigger standard intrusion detection systems.
The operational impact of this vulnerability extends beyond simple data leakage. Depending on the nature of the subset of JD Edwards EnterpriseOne Tools accessible data exposed, organizations may face risks related to intellectual property theft, customer privacy violations under regulations such as GDPR or CCPA, and potential downstream exploitation if the leaked information aids in further attacks against higher-value targets within the enterprise network. Although the immediate impact is limited to read access, compromised credentials or internal structural details obtained through this vector could serve as stepping stones for more severe intrusions, including privilege escalation or lateral movement across connected systems.
To mitigate this risk, organizations running affected versions of JD Edwards EnterpriseOne Tools must prioritize applying the latest security patches provided by Oracle. Immediate remediation involves updating to a version beyond 9.2.26.5 where these flaws have been addressed in the Web Runtime SEC component. In addition to patching, implementing strict access controls and network segmentation can help limit exposure. Deploying web application firewalls with rules designed to detect anomalous HTTP requests associated with this specific vulnerability pattern may provide an additional layer of defense. Furthermore, security awareness training for employees is critical given the requirement for human interaction in successful attacks; ensuring staff are vigilant against suspicious links or unexpected interactions within JD Edwards interfaces can significantly reduce the likelihood of exploitation. Regular audits of access logs should also be conducted to identify any potential indicators of compromise resulting from attempted exploits prior to patch deployment.