CVE-2026-91300 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools, affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is characterized by a difficult-to-exploit nature that permits an unauthenticated attacker to compromise the integrity of the application environment. The attack vector operates over HTTP, allowing remote access without prior authentication credentials. Despite the lack of required user privileges for initiation, the complexity of exploitation serves as a significant barrier against casual or automated attacks. This high level of difficulty in execution is reflected in the CVSS 3.1 Base Score of 3.1, which categorizes the severity as Low due to the specific constraints on attack conditions and impact scope.
From a technical perspective, this vulnerability aligns with CWE-79, commonly known as Cross-Site Scripting or potentially CWE-20 for Improper Input Validation depending on the exact mechanism of data manipulation within the Web Runtime SEC module. The flaw allows an attacker to inject malicious content or manipulate requests that result in unauthorized modifications to accessible data. Specifically, successful exploitation enables the insertion, update, or deletion of records within the JD Edwards EnterpriseOne Tools database or application state. This represents a direct compromise of data integrity rather than confidentiality or availability, as indicated by the CVSS vector components C:N and A:N with I:L for Low Integrity impact. The requirement for human interaction suggests that the vulnerability may involve social engineering elements or require a victim to perform an action such as clicking a malicious link or interacting with a crafted interface element triggered by the attacker's input.
In terms of operational impact, while the immediate consequence is unauthorized data modification, the broader implications depend heavily on the sensitivity of the data accessible through JD Edwards EnterpriseOne Tools. As an enterprise resource planning system handling critical business processes such as finance, supply chain management, and human resources, any unauthorized alteration to records can lead to significant financial loss, regulatory non-compliance, or operational disruption. Although the attack requires a victim other than the attacker to interact with the malicious payload, this does not eliminate risk in environments where users are frequently exposed to external communications or untrusted web content. The ability to delete data poses an even greater threat as it can lead to permanent loss of business information if backups are insufficient or recovery procedures are slow.
To mitigate this vulnerability, organizations must prioritize applying the latest security patches provided by Oracle for JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It is critical to verify that all instances running these affected versions have received the specific fix addressing the Web Runtime SEC component flaws. In addition to patching, implementing strict input validation and output encoding practices within custom developments or integrations can help reduce exposure if similar logic exists elsewhere in the application layer. Network-level controls such as web application firewalls should be configured to detect and block patterns associated with injection attacks or anomalous HTTP requests that attempt to manipulate data without proper authentication tokens. Furthermore, user awareness training is essential given the requirement for human interaction; employees should be educated on recognizing suspicious links or interactions originating from untrusted sources to prevent successful exploitation of this social engineering-dependent flaw.
The ATT&CK mapping for this vulnerability likely includes techniques related to Client-side Injection under the Execution tactic and Data Manipulation under the Impact tactic, specifically reflecting behaviors associated with CWE-79 if script injection is involved or CWE-20 if it involves general input validation failures leading to state changes. Security teams should monitor logs for unusual HTTP traffic patterns that deviate from standard user behavior, particularly those involving POST requests with unexpected parameters or responses indicating data modification events originating from unauthenticated sessions. Continuous monitoring and rapid response capabilities are vital to detect any attempted exploitation activities before they result in significant data integrity breaches within the enterprise environment.