CVE-2026-91298 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for their core business operations. The nature of the vulnerability allows an attacker with low privileges and network access via HTTP to compromise the integrity and confidentiality of the system. While the immediate target is the JD Edwards EnterpriseOne Tools environment, the potential scope change indicates that successful exploitation could lead to broader impacts across additional products within the Oracle ecosystem, thereby amplifying the overall risk profile for affected enterprises.
From a technical perspective, this vulnerability enables unauthorized access to data stored and managed by the application. Specifically, it permits an attacker to perform unauthorized updates, inserts, or deletes on accessible data, as well as gain unauthorized read access to a subset of that same data. This aligns with common weakness classifications such as CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, where the application fails to properly verify user permissions before allowing actions on sensitive resources. The ability to modify or exfiltrate data suggests a failure in input validation or access control mechanisms within the Web Runtime SEC component, potentially stemming from insecure direct object references or improper session management practices that allow low-level users to escalate their effective privileges during specific interactions.
The operational impact of this vulnerability is substantial due to its reliance on human interaction for exploitation. The requirement for user interaction classifies this as a type of social engineering vector, often associated with CWE-79 Improper Neutralization of Input During Web Page Generation or Cross-Site Scripting variants where an attacker tricks a legitimate user into performing actions that compromise the system. Although the attack complexity is listed as low and requires only network access via HTTP, the necessity for human involvement means that targeted phishing campaigns or malicious links embedded in trusted communications could effectively trigger the exploit. Once triggered, the consequences include data integrity loss through unauthorized modifications and confidentiality breaches through data exfiltration, which can lead to regulatory non-compliance, financial loss, and reputational damage depending on the sensitivity of the compromised records.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques involving Initial Access via Spearphishing Link or User Execution, followed by Data Exfiltration over HTTP/S for read operations and potentially Impact through Data Manipulation if write privileges are abused. The CVSS 3.1 base score of 5.4 reflects a medium severity level, driven primarily by the network-based attack vector and low complexity but tempered by the requirement for user interaction and limited availability impact. Organizations must recognize that while the immediate privilege requirement is low, the potential scope change elevates the risk to critical infrastructure components if lateral movement or further exploitation occurs post-compromise of this entry point.
Mitigation strategies should prioritize applying the latest security patches provided by Oracle JD Edwards immediately, as these typically address the underlying code flaws in the Web Runtime SEC component that allow unauthorized data access. In environments where patching is not immediately feasible, network segmentation and strict firewall rules can help restrict HTTP traffic to only necessary endpoints, reducing the attack surface available to low-privileged attackers. Additionally, implementing robust user awareness training programs is crucial given the human interaction requirement; employees should be educated on identifying suspicious links or requests that might attempt to exploit this vulnerability. Security monitoring tools should also be configured to detect anomalous data access patterns or unusual HTTP request volumes originating from internal users, which could indicate an active exploitation attempt against this flaw.