CVE-2026-91455 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the JD Edwards EnterpriseOne Tools product, specifically affecting the E1 Dev Platform Tech component on UNIX operating systems. This security flaw impacts supported software versions ranging from 9.2.0.0 through 9.2.26.5. The nature of this defect allows an unauthenticated attacker to exploit the weakness via network access using the HTTP protocol. Unlike many high-severity vulnerabilities that can be exploited automatically by remote scripts, this particular flaw requires human interaction from a user other than the attacker for successful exploitation. This characteristic significantly alters the risk profile and attack vector dynamics, placing it in a category where social engineering or deceptive practices may play a role in facilitating the initial compromise.
From a technical perspective, the vulnerability enables unauthorized modifications to data accessible by JD Edwards EnterpriseOne Tools. Successful exploitation results in both integrity and confidentiality impacts, allowing attackers to perform unauthorized updates, inserts, or deletes on specific datasets within the application environment. Additionally, it grants unauthorized read access to a subset of accessible data. This dual impact suggests that the flaw likely involves improper validation of user input or session management issues that allow an external actor to manipulate state or retrieve sensitive information without proper authentication credentials. The requirement for human interaction implies that the exploit mechanism may involve tricking a legitimate user into performing an action, such as clicking a malicious link or submitting crafted data through a web interface, which then triggers the underlying code flaw on the server side.
The operational impact of this vulnerability is moderate but significant depending on the sensitivity of the data involved. With a CVSS 3.1 Base Score of 5.4, the risk level is classified as medium. The specific vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates that while the attack complexity is low and no prior authentication is needed from the attacker's perspective, the necessity of user interaction serves as a critical control point for defense in depth. The confidentiality impact is listed as Low, meaning only limited sensitive information might be exposed, but the integrity impact is also Low, indicating potential data corruption or unauthorized changes that could disrupt business processes or lead to inaccurate reporting within the EnterpriseOne system.
In terms of industry standard classifications, this vulnerability aligns with CWE-79 for Cross-Site Scripting if it involves web-based injection, or potentially CWE-20 for Improper Input Validation if it relates to server-side processing errors. The requirement for user interaction and network access places it within the ATT&CK framework under techniques involving Initial Access via Phishing or Exploitation of Remote Services with User Interaction. Organizations must recognize that even vulnerabilities requiring human intervention can be effectively weaponized through targeted social engineering campaigns, making them a viable entry point for further lateral movement once inside the perimeter.
Mitigation strategies should focus on immediate patching to the latest supported version within the 9.2.x series where this flaw has been addressed by Oracle JD Edwards. Until patches are applied, network-level controls such as Web Application Firewalls can be configured to detect and block suspicious HTTP requests that exhibit patterns consistent with exploitation attempts. Additionally, implementing strict input validation on any custom integrations or extensions built upon the E1 Dev Platform Tech component is essential. Security awareness training for users interacting with JD Edwards interfaces should emphasize caution regarding unexpected prompts or links, reducing the likelihood of successful human interaction-based exploits. Regular auditing of access logs and data integrity checks can also help in early detection of unauthorized modifications resulting from such vulnerabilities.