EnterpriseOne Tools CVE-2026-91274

Exploitation targets the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools, reachable remotely over HTTP by an unauthenticated attacker (PR:N, UI:N) against affected versions 9.2.0.0 through 9.2.26.5. The key LIMITING factor is high attack complexity (AC:H): the attacker must meet conditions beyond their direct control - likely specific timing, state, or environmental preconditions - making reliable exploitation difficult rather than trivial. Exposure is further limited to deployments where the EnterpriseOne Tools HTTP interface (and its monitoring/diagnostics functionality) is network-accessible to the attacker; instances restricted to internal management networks or behind strict segmentation present a much smaller attack surface. Oracle's description does not name a specific toggle or non-default setting as a prerequisite, so the condition appears inherent to affected versions rather than configuration-gated.

This is a moderate-priority issue, not a top-tier emergency, despite its network-reachable unauthenticated profile. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 6.5) tells a nuanced story: exploitation is remote over HTTP and requires no privileges or user interaction, which raises exposure, but AC:H (high attack complexity) means a successful attack depends on conditions outside the attacker's control or on winning a race/meeting specific preconditions, which meaningfully dampens real-world exploitability. Impact is bounded - full read of JD Edwards-accessible data (C:H) but only partial integrity impact (I:L) and no availability impact (A:N) - so this is primarily a data-confidentiality concern rather than a service-takeover or RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no positive signal of active or imminent exploitation; absence of these is not proof of safety but, combined with AC:H, suggests this is not a mass-exploitation candidate. Note a tag/description tension: the input Tags include 'Authentication Bypass,' yet Oracle's description characterizes the flaw as unauthorized data access (not an auth-bypass primitive) and the CVSS is already PR:N - verify the actual mechanism with Oracle's CPU advisory before treating this as an authentication-bypass class issue. CWE is N/A and no root-cause detail is given, which limits deeper technical risk reasoning.

A remote attacker with no credentials sends crafted HTTP requests to an internet- or network-exposed JD Edwards EnterpriseOne Tools instance (Monitoring and Diagnostics SEC component), exploiting the flaw to read sensitive business data and make limited unauthorized modifications. Because the CVSS vector specifies high attack complexity (AC:H), the attacker must satisfy non-trivial preconditions or timing, so success is not guaranteed on first attempt. No public exploit code was identified at time of analysis, so any attack would currently require independent vulnerability research.