CVE-2026-91290 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting version ranges from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for their critical business operations. The core issue stems from insufficient access control mechanisms within the web runtime environment, which fails to properly enforce authorization checks when processing requests directed at sensitive data endpoints. As a result, an attacker who has successfully authenticated and obtained low-privileged user credentials can exploit these weaknesses to bypass intended security restrictions. This type of flaw is commonly categorized under CWE-269, Improper Privilege Management, or more specifically CWE-862, Missing Authorization, depending on the exact nature of the access control failure within the application logic.
The operational impact of this vulnerability is substantial due to its potential for unauthorized data exfiltration. A successful exploitation allows a low privileged attacker with valid logon credentials to compromise the integrity and confidentiality of the JD Edwards EnterpriseOne Tools environment. The primary consequence is the ability to gain unauthorized access to critical business data that should be restricted based on user roles or permissions. In severe cases, this can lead to complete access to all data accessible by the application infrastructure, exposing sensitive financial records, customer information, and proprietary operational details. This aligns with the ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to move laterally or extract data without triggering typical intrusion detection systems that look for unauthorized login attempts.
The CVSS 3.1 base score of 5.5 reflects a medium severity rating driven primarily by high confidentiality impacts while maintaining low availability and integrity impacts in the baseline vector. The attack vector is local, requiring physical or network proximity to the infrastructure where JD Edwards executes, which limits remote exploitation but increases risk for insider threats or compromised internal workstations. The requirement for user interaction is none, meaning automation tools can be used once initial access is gained through credential theft or phishing attacks targeting low-privileged users. This profile suggests that while not immediately critical for remote code execution scenarios, it poses a persistent threat to data governance and compliance requirements such as GDPR, HIPAA, or SOX if sensitive records are exposed without authorization.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective solution is to apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5, which address the specific access control flaws in the Web Runtime SEC component. Organizations should also implement strict role-based access controls ensuring that users operate with only the minimum privileges necessary to perform their duties, thereby reducing the attack surface available to low-privileged accounts. Additionally, deploying network segmentation and monitoring tools can help detect anomalous data access patterns originating from internal sources. Regular audits of user permissions and enforcement of multi-factor authentication for all administrative and sensitive application interfaces will further reduce the likelihood of successful exploitation by limiting credential availability and verifying identity rigorously.