JD Edwards Orchestrator CVE-2026-91277

Requires network access over HTTP to a running JD Edwards EnterpriseOne Orchestrator instance exposing the E1 IOT Orchestrator Security component; affected supported versions are 9.2.0.0 through 9.2.26.5. No authentication, no privileges, and no user interaction are required (PR:N/UI:N), so any network-reachable instance in that version range is exploitable in its as-deployed state. The main limiting factor is reachability: Orchestrator is typically an internal/integration-tier service, so risk is dominated by whether the endpoint is exposed to untrusted networks or the internet rather than by any special configuration. Impact is further bounded to read access to only a subset of Orchestrator data (C:L, I:N, A:N).

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) carrying confidentiality-only impact with no integrity or availability effect. The CVSS vector is favorable to attackers on exposure metrics - network attack vector, low complexity, no privileges, and no user interaction - meaning any reachable instance can be probed by an unauthenticated remote attacker. However, the actual damage is capped: Oracle describes only 'unauthorized read access to a subset' of Orchestrator data, which is why the score lands at 5.3 (medium) rather than critical despite the easy exploitability. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical takeaway: this is an easily-triggerable but low-impact issue - a genuine patch-in-the-next-cycle item for internet-exposed Orchestrator instances rather than an emergency. One signal conflict to note: the input Tags include 'Authentication Bypass', but Oracle's description characterizes the issue as unauthorized partial read access, not a full authentication bypass; treat the tag as loosely applied and rely on the CVSS confidentiality-only profile.

An unauthenticated attacker with network reachability to an internet-exposed or internal JD Edwards EnterpriseOne Orchestrator endpoint sends a crafted HTTP request to the E1 IOT Orchestrator Security component. Because no authentication or user interaction is required (PR:N/UI:N), the request returns a subset of Orchestrator-accessible data the attacker should not be able to read. No public exploit code was identified in the provided intelligence, so this reflects the vector's theoretical ease rather than a confirmed in-the-wild technique.