CVE-2026-91308 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Installation Security component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is characterized by its high exploitability and broad attack surface, as it permits unauthenticated attackers to gain access via network connections using the Oracle Net protocol. The core technical issue stems from a deficiency in how the installation or initial configuration processes handle authentication checks for certain administrative or data-access endpoints. Because the vulnerability allows exploitation without prior credentials, it represents a critical failure in the principle of least privilege and proper access control enforcement during the setup or maintenance phases of the software lifecycle. This type of flaw is typically categorized under CWE-287, which describes Improper Authentication, where an actor is able to bypass authentication mechanisms due to logic errors or misconfigurations inherent in the installation security module.
The operational impact of this vulnerability is severe, primarily driven by its high confidentiality rating within the CVSS 3.1 scoring system. A successful exploitation allows a remote attacker with network access to compromise JD Edwards EnterpriseOne Tools without any user interaction or prior authentication. The direct consequence is unauthorized access to critical business data stored within the enterprise resource planning environment. In many scenarios, this can escalate to complete access to all data accessible by the JD Edwards tools, effectively granting the attacker full visibility into sensitive financial records, customer information, and proprietary operational metrics. This level of exposure aligns with ATT&CK technique T1078, Valid Accounts, although in this specific case, it may also relate to T1539, Steal Web Session Cookie, if session tokens are compromised during the unauthenticated access phase, or more broadly under Initial Access techniques that leverage exposed administrative interfaces. The lack of integrity and availability impacts suggests that while data theft is the primary concern, the underlying mechanism could potentially be leveraged for further lateral movement within a networked environment where JD Edwards systems reside.
Mitigation strategies must focus on immediate remediation through vendor-provided patches or updates to bring affected versions above 9.2.26.5. Organizations running these specific versions should prioritize applying the latest security bundles released by Oracle, which address the authentication bypass logic within the Installation Security component. In addition to patching, network-level controls are essential for defense in depth. Administrators should restrict access to JD Edwards management interfaces and installation tools using firewalls or virtual private networks, ensuring that only authorized administrative IP addresses can reach these services over Oracle Net. Furthermore, implementing strict input validation and enforcing multi-factor authentication on any remaining accessible administrative portals can reduce the risk of exploitation if similar vulnerabilities exist in other components. Regular vulnerability scanning focused on unauthenticated access points will help identify residual risks or misconfigurations that might expose this specific flaw to external threats.