CVE-2026-91295 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a critical weakness in the application's authentication and authorization mechanisms, allowing for unauthorized access to sensitive system resources. The vulnerability is classified as easily exploitable due to its low complexity requirements, meaning that an attacker does not need sophisticated tools or specific user interaction to trigger the exploit. Instead, the attack vector relies on network accessibility via HTTP, which significantly broadens the potential surface area for exploitation by allowing remote attackers to target systems over standard web protocols without requiring physical access or local privileges beyond basic network connectivity.
From a technical perspective, this vulnerability enables low-privileged users who possess valid credentials but lack administrative rights to escalate their privilege level and achieve full control over the JD Edwards EnterpriseOne Tools environment. The core issue likely involves improper validation of user roles or session tokens during HTTP requests, allowing an attacker to bypass intended security restrictions. By manipulating specific parameters within HTTP traffic, a malicious actor can execute commands or access data that should be restricted to higher-level administrators. This type of flaw is commonly associated with broken access control mechanisms where the application fails to enforce proper separation between user roles and administrative functions, leading to unauthorized privilege escalation.
The operational impact of this vulnerability is severe, as indicated by its CVSS 3.1 Base Score of 8.8, which denotes a high severity level. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack has network-based accessibility with low complexity and requires only low-privileged initial access, yet it results in high impacts across confidentiality, integrity, and availability. A successful exploitation allows an attacker to take over the JD Edwards EnterpriseOne Tools instance completely. This compromise can lead to the exfiltration of sensitive business data, modification or deletion of critical financial records, and disruption of enterprise operations. The ability to achieve full takeover means that attackers could install backdoors, pivot into other parts of the network, or use the compromised system as a launchpad for further attacks against connected systems within the organization's infrastructure.
In terms of industry standards, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, which describe scenarios where users are granted access to resources they should not have permission to view or modify. Furthermore, from a threat modeling perspective such as MITRE ATT&CK, this behavior corresponds to techniques involving Account Manipulation and potentially Command and Control if the attacker establishes persistent access after gaining initial foothold through privilege escalation. The network-based nature of the attack also relates to Initial Access vectors where attackers leverage exposed services to gain entry into protected networks.
To mitigate this risk, organizations running affected versions must immediately apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne Tools version 9.2.x. It is crucial to verify that all instances within the enterprise environment are updated to a patched release above 9.2.26.5 or whichever specific patch level addresses this CVE. In addition to applying vendor-supplied fixes, administrators should enforce strict network segmentation policies to limit HTTP access to only authorized IP ranges and implement robust web application firewalls capable of detecting anomalous privilege escalation attempts. Regular auditing of user permissions and role assignments is also recommended to ensure that low-privileged accounts do not possess unnecessary administrative capabilities, thereby reducing the blast radius in case of a future vulnerability discovery.