CVE-2026-91287 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for critical business operations. The core issue stems from insufficient authentication mechanisms or improper access control configurations within the underlying infrastructure services, which allows an attacker who has gained physical proximity to the network segment hosting the JD Edwards server to exploit the system without providing valid credentials. This characteristic classifies the vulnerability as one that can be exploited by unauthenticated attackers with local network access, highlighting a critical gap in the defense-in-depth strategy typically expected for enterprise-grade applications.
From a technical perspective, this flaw aligns closely with CWE-287, which describes Improper Authentication, and potentially CWE-306, Missing Authentication for Critical Function, depending on the specific implementation details of how the SEC component handles incoming requests from the physical communication segment. The attacker does not need to interact directly with a user interface or trick an administrator into performing any action, as indicated by the absence of user interaction requirements in the CVSS vector. Instead, the vulnerability can be triggered remotely over the network if the attacker is connected to the same broadcast domain or subnet where the JD Edwards server resides. This often implies that legacy protocols, unencrypted management interfaces, or misconfigured service endpoints are exposed and accepting connections from any source on the local segment without verifying the identity of the requester.
The operational impact of this vulnerability is severe, as evidenced by a CVSS 3.1 Base Score of 8.1, which indicates a High severity level. The attack vector is Adjacent Network (AV:A), meaning physical access to the LAN or VLAN where the server operates is sufficient for exploitation. With low complexity and no prerequisites regarding user interaction, the barrier to entry for an attacker with internal network access is minimal. Successful exploitation allows the adversary to compromise both confidentiality and integrity of the data managed by JD Edwards EnterpriseOne Tools. This means that sensitive business information such as financial records, employee data, supply chain details, and customer profiles can be exfiltrated without detection or authorization. Furthermore, the ability to modify critical data introduces significant risks for operational continuity and regulatory compliance, as attackers could alter transactional records, delete essential datasets, or inject malicious logic into the system's database.
In terms of threat modeling, this vulnerability facilitates actions consistent with several tactics in the MITRE ATT&CK framework. An attacker leveraging this flaw would likely engage in Initial Access via valid accounts obtained through network-level exploitation or directly access data without authentication. The subsequent steps would involve Data Exfiltration to steal sensitive information and potentially Impact by modifying system configuration or data integrity, which could lead to financial fraud or operational disruption. Because the impact includes complete access to all JD Edwards accessible data, the potential for lateral movement within the broader enterprise network is also elevated if the compromised server holds keys or credentials that provide further footholds into other systems.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for their specific version of JD Edwards EnterpriseOne Tools. Until patching can be performed, it is imperative to implement strict network segmentation strategies. The JD Edwards servers should not reside on a general-purpose LAN segment accessible to all employees or guest networks; instead, they should be isolated in dedicated VLANs with access control lists that restrict connectivity only to authorized application clients and management stations. Additionally, enabling mutual TLS authentication for internal service communications can prevent unauthorized entities from interacting with the SEC component even if they are present on the network segment. Regular vulnerability assessments focused on identifying exposed services and misconfigured permissions within the enterprise infrastructure will help ensure that such gaps do not persist in production environments.