JD Edwards Orchestrator CVE-2026-91276

Exploitation requires network HTTP access to the JD Edwards EnterpriseOne Orchestrator (component: E1 IOT Orchestrator Security) on affected versions 9.2.0.0 through 9.2.26.5. No attacker authentication is needed (PR:N), but the attack is explicitly rated difficult (AC:H) and REQUIRES human interaction from a legitimate user other than the attacker (UI:R) - meaning a victim must be induced to perform some action for the attack to succeed. These two factors (high complexity plus mandatory victim interaction) are the primary limiters and substantially reduce realistic exploitability despite the unauthenticated network vector; impact is confined to unauthorized data disclosure with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw (Oracle CVSS 3.1 base 5.3) whose real-world risk is tempered by multiple limiting factors. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N shows network reach and no authentication (PR:N), but high attack complexity (AC:H, described by Oracle as 'difficult to exploit') and required user interaction (UI:R) from a victim other than the attacker. Impact is confidentiality-only (C:H, I:N, A:N) - unauthorized read access to all Orchestrator-accessible data, with no integrity or availability loss. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a lower-priority, patch-in-normal-cycle issue rather than an emergency. Two caveats: the input Tag 'Authentication Bypass' conflicts with the description, which characterizes the flaw as a complexity- and interaction-gated data-disclosure bug, not a true authentication bypass - treat that tag as unverified. Oracle credits itself (secalert_us@oracle.com) as reporter and the only reference is the October 2026 Critical Patch Update, so severity and affected versions are vendor-confirmed but no independent corroboration exists.

An unauthenticated attacker crafts a malicious HTTP link or resource targeting the JD Edwards EnterpriseOne Orchestrator and lures an authorized user into interacting with it. Because the attack is difficult to execute (AC:H) and depends on that victim action (UI:R), success is not guaranteed, but a successful attack yields read access to critical or all Orchestrator-accessible data. No public proof-of-concept exploit is available at time of analysis.