JD Edwards EnterpriseOne CVE-2026-91275

Exploitation requires the attacker to already hold high privileges (PR:H) within JD Edwards EnterpriseOne Tools and to interact over the network via SQL against the Monitoring and Diagnostics SEC component. Exploitation is further LIMITED by high attack complexity (AC:H): Oracle explicitly rates it 'difficult to exploit,' indicating success depends on conditions beyond the attacker's direct control. No user interaction is required (UI:N). The elevated effective severity comes from the scope change (S:C), allowing impact to propagate to additional connected products. Applies to supported versions 9.2.0.0 through 9.2.26.5; there is no unauthenticated or low-privilege path based on the vendor vector.

This is a moderate-severity (CVSS 3.1 base 6.6) vulnerability whose real-world risk is substantially constrained by its own attack metrics. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) requires BOTH high privileges (PR:H) AND high attack complexity (AC:H), meaning an attacker must already be an authenticated, high-privileged user and must overcome conditions outside their control - a significant barrier that pushes this toward an insider-abuse or post-compromise escalation threat rather than a mass-exploitable perimeter issue. The scope change (S:C) is the aggravating factor that keeps the score above 6.0, reflecting Oracle's statement that attacks 'may significantly impact additional products.' No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent exploitation; status is therefore 'no public exploit identified at time of analysis.' CONFLICTING SIGNAL: the input Tags include 'Authentication Bypass,' which directly contradicts the Oracle-supplied CVSS vector of PR:H (high privileges required) - a true authentication bypass would imply PR:N. Trust the Oracle CVSS vector over the tag; treat the 'Authentication Bypass' label as likely mislabeled. Overall this is a high-CVSS-contributor-but-low-real-world-urgency issue: patch in the normal Oracle CPU cycle, prioritize only where untrusted or semi-trusted high-privileged JDE accounts exist.

A high-privileged JD Edwards EnterpriseOne Tools user (or an attacker who has already compromised such an account) leverages network-accessible SQL functionality in the Monitoring and Diagnostics SEC component to read critical data and perform limited unauthorized writes. Because the vulnerability causes a scope change, the successful attack can spill over to significantly impact additional connected products beyond JDE Tools itself. Exploitation is rated difficult (AC:H) and no public exploit code was identified, so this most plausibly represents malicious-insider abuse or lateral movement after an initial compromise rather than opportunistic external attack.