CVE-2026-91296 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a critical risk to organizations relying on this enterprise resource planning platform for their core business operations. The nature of the vulnerability allows an unauthenticated attacker who has network access via HTTP to compromise the integrity and availability of the JD Edwards EnterpriseOne Tools environment. While the attack vector is remote, it requires human interaction from a victim other than the initial attacker, indicating that social engineering or phishing tactics are likely necessary to trigger the exploit condition. This characteristic aligns with common patterns in web application vulnerabilities where user action, such as clicking a malicious link or submitting crafted input through a legitimate interface, serves as the catalyst for code execution or state manipulation.
From a technical perspective, the vulnerability enables an attacker to achieve full takeover of the JD Edwards EnterpriseOne Tools instance. This level of compromise implies that the attacker can execute arbitrary commands, modify system configurations, access sensitive data, and potentially pivot to other systems within the network infrastructure. The high severity is reflected in the CVSS 3.1 Base Score of 8.8, which indicates a High risk rating due to significant impacts on confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that the attack is network-based with low complexity, requires no prior authentication but does require user interaction, has an unchanged scope, and results in high impacts across all three security pillars. This suggests a severe flaw such as a server-side request forgery leading to remote code execution or a critical injection vulnerability within the HTTP handling mechanisms of the SEC component.
The operational impact of this vulnerability is substantial for any organization running affected versions of JD Edwards EnterpriseOne Tools. A successful exploitation could lead to unauthorized access to confidential business data, including financial records, customer information, and proprietary intellectual property stored within the ERP system. Furthermore, an attacker gaining control over the application server can disrupt critical business processes by altering transactional data or rendering the system unavailable through denial-of-service conditions. The requirement for human interaction does not significantly mitigate the risk in enterprise environments where employees are frequent targets of sophisticated phishing campaigns designed to trick users into interacting with malicious URLs that trigger this vulnerability. Consequently, the potential for widespread organizational disruption and data breach remains high if left unaddressed.
To mitigate this risk, immediate action is required by system administrators and security teams responsible for maintaining JD Edwards EnterpriseOne environments. The primary remediation step involves applying the latest patches or updates provided by Oracle to bring all affected instances of JD Edwards EnterpriseOne Tools to a version beyond 9.2.26.5 where these vulnerabilities have been resolved. In addition to patching, organizations should implement strict access controls and network segmentation to limit HTTP exposure to only necessary IP addresses and users. Deploying web application firewalls can also help by filtering out malicious payloads that attempt to exploit this flaw before they reach the vulnerable component. Continuous monitoring of system logs for anomalous activity related to unauthenticated access attempts is recommended as a defensive measure while patching efforts are underway.
This vulnerability maps closely to CWE-79, which covers Cross-site Scripting vulnerabilities if the exploitation involves client-side code injection, or more likely CWE-502 regarding Deserialization of Untrusted Data if the compromise stems from processing malicious objects via HTTP requests. In terms of offensive security frameworks, this aligns with MITRE ATT&CK techniques such as T1190 Exploit Public-Facing Application and potentially T1078 Valid Accounts if the human interaction leads to credential theft or privilege escalation. Understanding these mappings helps in categorizing the threat within broader cybersecurity defense strategies and ensures that incident response procedures are updated to address similar exploitation vectors in the future. Organizations must prioritize this remediation due to the high severity score and the potential for complete system compromise, which poses a direct threat to business continuity and data security integrity.