CVE-2026-91297 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to enterprise resource planning environments that rely on this software for operational continuity and data integrity. The vulnerability is characterized by an easily exploitable condition that permits unauthenticated attackers with network access via the HTTP protocol to compromise the system. Unlike many high-severity vulnerabilities that allow immediate remote code execution or full system takeover, this specific flaw introduces a nuanced attack vector where successful exploitation requires human interaction from a user other than the attacker. This social engineering aspect suggests that the vulnerability likely involves deceptive content delivery or malicious link injection within the monitoring and diagnostics interface, compelling an authorized but unsuspecting user to perform actions that trigger the underlying code defect.
From a technical perspective, the core issue lies in how the application processes inputs received over HTTP without adequate authentication checks for certain diagnostic endpoints. While the initial access is unauthenticated, the actual exploitation chain depends on tricking a legitimate user into interacting with maliciously crafted content or URLs presented through the JD Edwards interface. This interaction allows the attacker to bypass standard security controls that would otherwise restrict data manipulation capabilities. The presence of this flaw indicates insufficient input validation and improper authorization checks within the monitoring module, allowing an attacker to manipulate server-side operations under the guise of a legitimate user session once human interaction has been facilitated.
The operational impact of this vulnerability is substantial due to its scope change characteristic. Although the technical flaw exists specifically in JD Edwards EnterpriseOne Tools, successful attacks can significantly impact additional products and services integrated with or dependent on the compromised system. This lateral movement potential means that compromising the monitoring tools could serve as a foothold for broader enterprise compromise. The direct consequences of exploitation include unauthorized updates, inserts, or deletes to accessible data within JD Edwards EnterpriseOne Tools. Furthermore, attackers gain unauthorized read access to a subset of this data. These actions directly violate the principles of confidentiality and integrity, potentially leading to data corruption, loss of sensitive business information, and manipulation of critical enterprise records without detection by standard audit logs if logging mechanisms are also bypassed or manipulated during the attack sequence.
In terms of industry-standard classification, this vulnerability aligns with CWE-79 for Cross-Site Scripting or similar injection flaws that require user interaction, as well as CWE-269 regarding Improper Privilege Escalation if the human interaction leads to elevated access levels. The requirement for human interaction places it within the ATT&CK technique of Social Engineering (T1534) combined with Remote Services exploitation techniques such as T1071 Application Layer Protocol: Web Protocols. The CVSS 3.1 base score of 6.1 reflects a medium severity rating, driven by network accessibility and low complexity but tempered by the need for user interaction and limited availability impact.
Mitigation strategies must address both immediate technical controls and broader security hygiene practices. Oracle has released patches to resolve this vulnerability in supported versions; therefore, applying the latest available updates is the primary remediation step. Organizations should prioritize patching JD Edwards EnterpriseOne Tools instances that are exposed to HTTP traffic or accessible by users who might interact with external links within the monitoring dashboard. Additionally, implementing strict access controls for diagnostic and monitoring endpoints can limit exposure even if vulnerabilities exist in older versions not yet patched. Security awareness training is crucial given the social engineering aspect of this flaw; employees should be educated on recognizing suspicious content within enterprise applications. Network segmentation and web application firewalls may also provide an additional layer of defense by inspecting HTTP traffic for malicious patterns associated with exploitation attempts, although they cannot replace timely patch management as a definitive solution.