JD Edwards EnterpriseOne CVE-2026-91269

Exploitation targets the Enterprise Infrastructure SEC (security) component of JD Edwards EnterpriseOne Tools, reachable over HTTP. Per the CVSS vector (PR:L) and Oracle's own wording, the attacker must be a low-privileged authenticated principal - i.e., possess valid low-level EnterpriseOne credentials or a valid session - so a network-exposed but unauthenticated attacker cannot exploit it as scored. Limiting factors: requires network/HTTP access to the EnterpriseOne Tools web tier and a low-privilege foothold; only versions 9.2.0.0 through 9.2.26.5 are affected; no user interaction is needed and attack complexity is low, so once an attacker is authenticated there are no further special configuration prerequisites named in the advisory. Note: if the 'Authentication Bypass' tag is accurate, the authentication prerequisite may not hold - confirm with Oracle.

This is a genuine high-priority vulnerability for organizations running JD Edwards EnterpriseOne Tools, but not an emergency across the broader internet. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact (no availability impact) - Oracle characterizes it as 'easily exploitable.' However, exploitation signals are weak-to-absent: no CISA KEV listing, no public proof-of-concept, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the data. There is a notable conflict to verify: the 'Authentication Bypass' tag implies no authentication (which would be PR:N), yet both the Oracle description ('low privileged attacker') and the CVSS vector specify PR:L (authenticated). This contradiction should be resolved with Oracle before treating the issue as a pre-auth bypass; as scored, an attacker needs valid low-privilege credentials/session on the EnterpriseOne Tools instance. Net: a real, high-severity post-authentication flaw worth prioritized patching on exposed ERP systems, but current public telemetry does not indicate active or widespread exploitation.

An attacker who already holds a low-privilege EnterpriseOne application account (or has obtained a valid session) sends crafted HTTP requests to the Enterprise Infrastructure SEC component to escalate access, reading and tampering with critical business data across the environment. No public exploit code was identified at the time of analysis, and the low attack complexity means a working exploit would be straightforward for an authenticated adversary once technical details are known.