JD Edwards EnterpriseOne CVE-2026-91267

Exploitation requires network reachability to the JD Edwards EnterpriseOne Tools Interoperability interface exposed over SOAP (the 'Interoperability SEC' component); this web-services/SOAP endpoint must be deployed and accessible to the attacker. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), so default-configured instances that expose the SOAP Interoperability service to a reachable network are exploitable. The primary limiting factor is exposure of that SOAP endpoint - environments where the Interoperability web service is not deployed, is restricted to internal/segmented networks, or is fronted by authenticating gateways substantially reduce reachability. Only confidentiality is at risk (no integrity or availability impact). Affected versions are strictly 9.2.0.0 through 9.2.26.5.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) describes the worst-case exposure profile short of code execution: network-reachable, low-complexity, no privileges, no user interaction, with a scope change amplifying impact to additional products. Oracle's own 'Easily exploitable' language reinforces the AC:L rating. However, several corroborating signals are absent: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent mass exploitation yet. The impact is confidentiality-only (I:N/A:N) - this is an information-disclosure/data-access flaw, not RCE or a destructive bug, which tempers the practical severity somewhat despite the 8.6 score. Net: treat as a priority patch for any exposed JD Edwards EnterpriseOne Tools instance (especially internet-facing SOAP endpoints) given the unauthenticated network vector, while recognizing that exploitation-probability telemetry (EPSS/KEV/POC) is currently missing and cannot confirm real-world attack activity.

An attacker with network access to the JD Edwards EnterpriseOne Tools Interoperability SOAP interface sends a crafted SOAP request without any credentials, abusing the Interoperability SEC component to bypass access controls and read sensitive application data. Because the CVSS scope is changed, the compromise can reach data belonging to additional connected products beyond the Tools layer itself. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make exploitation straightforward if the endpoint is reachable.