CVE-2026-91292 in JD Edwards EnterpriseOne Localizations
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD Edwards (component: LATAM). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Localizations. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Localizations accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Localizations. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the LATAM component of Oracle JD Edwards EnterpriseOne Localizations, specifically affecting version 9.2. This security flaw is characterized by its susceptibility to exploitation by attackers who possess low-level privileges and have network access via the JDENET protocol. The nature of this weakness allows an unauthorized actor to compromise the integrity and availability of the localized data processing functions within the enterprise resource planning system. The vulnerability stems from insufficient validation or access control mechanisms inherent in how the LATAM module processes incoming requests over the network, enabling malicious actors to interact with sensitive subsystems without requiring elevated administrative rights or user interaction.
From a technical perspective, this flaw facilitates two primary categories of adverse outcomes: unauthorized data exposure and service disruption. The first impact involves confidential information leakage, where an attacker can read a subset of JD Edwards EnterpriseOne Localizations accessible data that should otherwise remain restricted to authorized personnel with higher privilege levels. This indicates a breakdown in access control logic, allowing lateral movement or data exfiltration from areas not intended for low-privileged users. Concurrently, the vulnerability permits actions that lead to a partial denial of service against the JD Edwards EnterpriseOne Localizations component. By triggering resource exhaustion or processing loops through crafted network requests, an attacker can degrade system performance or render specific localization features temporarily unavailable, thereby impacting business continuity and operational efficiency in regions relying on these localized services.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 5.4, reflecting moderate risk due to its combination of confidentiality and availability impacts while maintaining low complexity and no requirement for user interaction. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) confirms that the attack surface is network-accessible, requires only local privileges on the attacking host to initiate exploitation, and results in limited confidentiality loss alongside partial availability degradation. In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-732 Incorrect Permission Assignment for Critical Resource, as it involves a low-privileged user gaining unintended access rights. Furthermore, the operational behavior maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter if script-based exploitation is involved, or more broadly under Initial Access and Impact tactics depending on whether data theft or service disruption is prioritized by the attacker.
To mitigate this risk, organizations running JD Edwards EnterpriseOne version 9.2 must prioritize applying the latest security patches provided by Oracle for the LATAM localization component. Immediate remediation should focus on restricting network access to the JDENET interface through firewall rules and intrusion prevention systems that filter out malformed or suspicious request patterns targeting known vulnerable endpoints. Additionally, implementing strict role-based access controls ensures that even if an attacker gains low-level entry, their ability to query sensitive data structures is minimized by default. Regular auditing of user permissions within the localization modules can help identify accounts with excessive privileges that could be leveraged in such attacks. Monitoring network traffic for anomalies indicative of denial-of-service attempts or unusual data retrieval patterns will also aid in early detection and response to potential exploitation activities.