CVE-2026-91310 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Installation SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a critical weakness in the authentication and authorization mechanisms that govern access to the enterprise resource planning platform. The nature of this vulnerability allows for exploitation by an attacker who possesses only low-level privileges, significantly lowering the barrier to entry compared to vulnerabilities requiring administrative or high-privileged accounts. This characteristic aligns with common patterns seen in improper privilege management flaws where default configurations or insufficient validation checks allow users with minimal initial access to escalate their rights within the application environment.
Exploitation of this vulnerability is facilitated through network connectivity via JDENET, which is Oracle's proprietary communication protocol used for client-server interactions in JD Edwards environments. The low complexity of the attack vector indicates that no special conditions or user interaction are required beyond establishing a valid connection to the affected service. An attacker can leverage standard network tools and scripts to craft malicious requests that trigger the underlying flaw during the installation security processing phase. This ease of exploitation makes it particularly dangerous in enterprise settings where JDENET ports may be exposed to internal networks, allowing any authenticated user on the same subnet or with valid credentials for a low-privilege account to initiate an attack without detection by standard perimeter defenses designed to block unauthenticated access attempts.
The operational impact of this vulnerability is severe, as successful exploitation results in complete takeover of the JD Edwards EnterpriseOne Tools environment. This level of compromise corresponds to high impacts across all three pillars of the CVSS 3.1 base score: confidentiality, integrity, and availability. In terms of confidentiality, an attacker gains unrestricted access to sensitive business data stored within the ERP system, including financial records, customer information, and proprietary operational metrics. Regarding integrity, the ability to take over the application allows for unauthorized modification or deletion of critical configuration settings, master data, and transactional records, potentially leading to significant financial loss or regulatory non-compliance. For availability, an attacker can disrupt services by crashing processes or locking out legitimate users, effectively halting business operations dependent on the ERP system.
From a classification perspective, this vulnerability is best categorized under CWE-269: Improper Privilege Management and CWE-732: Incorrect Permission Assignment for Critical Resource. The ability of a low-privileged user to escalate privileges through network-based interaction highlights a failure in enforcing least privilege principles during the installation security setup process. In terms of adversary behavior, this aligns with MITRE ATT&CK technique T1068: Exploitation for Privilege Escalation and potentially T1547: Boot or Logon Autostart Execution if the takeover involves persistence mechanisms within the application layer. The network-based nature also relates to T1021: Remote Services, as JDENET serves as a remote service interface that is being abused due to insufficient access controls.
Mitigation strategies must focus on immediate patching and rigorous access control reviews. Oracle has released updates for versions 9.2.0.0 through 9.2.26.5 to address this specific flaw in the Installation SEC component, making the application of these patches the primary remediation step. Organizations should prioritize applying these updates across all affected instances immediately. In addition to patching, it is crucial to audit JDENET access policies to ensure that only necessary users have network connectivity to the ERP servers. Implementing strict firewall rules to restrict JDENET traffic to known and trusted IP addresses can reduce the attack surface significantly. Furthermore, enforcing multi-factor authentication for all user accounts, even low-privileged ones, adds a layer of defense against credential-based exploitation attempts associated with this vulnerability type. Regular security assessments and penetration testing focused on privilege escalation paths within ERP systems are recommended to identify similar weaknesses before they can be exploited in production environments.