CVE-2026-91294 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Business Logic Infrastructure Security component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting version ranges from 9.2.0.0 through 9.2.26.5. This security flaw is classified as an easily exploitable issue that allows a low-privileged attacker to compromise the integrity and availability of the application environment. The attack vector requires network access via JDENET, which is Oracle’s proprietary protocol used for communication between client applications and the EnterpriseOne server components. Because the vulnerability can be triggered by an attacker with only low-level privileges who does not require user interaction or complex preconditions, it represents a significant risk to organizations relying on this enterprise resource planning platform for critical business operations.
From a technical perspective, the core of this weakness lies in how the Business Logic Infrastructure handles specific requests processed over the JDENET protocol. The flaw enables an authenticated but low-privileged user to send malformed or excessively demanding inputs that trigger unintended behavior within the application logic layer. This mismanagement leads directly to resource exhaustion conditions on the server side. Unlike vulnerabilities that allow for data exfiltration or remote code execution, this specific defect is primarily focused on disrupting service continuity. The attacker can exploit the flaw repeatedly to consume system resources such as memory, CPU cycles, or thread pools associated with processing JDENET requests, thereby degrading the performance of the entire EnterpriseOne instance rather than just a single user session.
The operational impact of this vulnerability centers heavily on availability, which is reflected in its CVSS 3.1 base score of 4.3 and the specific emphasis on Availability impacts within the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. A successful exploitation results in a partial denial of service against JD Edwards EnterpriseOne Tools. This means that while the system may not crash entirely, its responsiveness becomes severely degraded for legitimate users attempting to perform daily tasks such as data entry, reporting, or transaction processing. In an enterprise environment where uptime and consistent performance are critical, even a partial degradation can lead to significant productivity losses, delayed decision-making, and potential financial impact due to operational inefficiencies. The lack of confidentiality or integrity impacts indicates that the attacker cannot currently steal sensitive data or modify records through this specific vector alone, but the disruption itself poses a substantial threat to business continuity.
This vulnerability aligns with Common Weakness Enumeration categories related to resource management failures, particularly CWE-400: Uncontrolled Resource Consumption and potentially CWE-755: Improper Handling of Unexpected Exceptional Condition depending on the exact internal mechanism triggering the denial of service. In terms of offensive security frameworks, this behavior maps closely to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion or resource flooding. The requirement for low privileges and network access via JDENET highlights the importance of strict segmentation and least-privilege principles in securing enterprise applications exposed over internal networks.
To mitigate this risk, organizations should prioritize applying the latest security patches provided by Oracle that address flaws within the Business Logic Infrastructure Security component. It is essential to verify whether deployed systems fall within the affected version range of 9.2.0.0 to 9.2.26.5 and ensure they are updated to a patched release where this logic error has been resolved. In addition to patching, implementing network-level controls such as rate limiting on JDENET traffic can help mitigate the impact if an attacker attempts to flood the service with requests. Monitoring system resources for unusual spikes in CPU or memory usage associated with JD Edwards processes may also provide early detection of exploitation attempts. Furthermore, ensuring that all user accounts adhere strictly to least-privilege principles reduces the attack surface by limiting which users possess the necessary permissions to trigger this specific code path within the application logic layer.