JD Edwards EnterpriseOne CVE-2026-91279

Exploitation requires an active/authenticated JD Edwards EnterpriseOne Tools user (versions 9.2.0.0 through 9.2.26.5) to interact with attacker-supplied content delivered over HTTP to the Web Runtime SEC component - per UI:R, the attack cannot succeed without this human interaction from someone other than the attacker, which is the primary limiting factor. The attacker themselves needs no credentials (PR:N) and no special target configuration is stated, but the scope change (S:C) means impact can extend to other products sharing the session/trust context. Realistic risk is therefore bounded by the need to socially engineer or lure a legitimate user, and impact is limited to partial read and partial update/insert/delete of accessible data (no availability loss).

This is a genuinely moderate-priority issue, not a top-tier emergency, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a network-reachable, low-complexity, unauthenticated flaw that nevertheless REQUIRES user interaction (UI:R) and yields only low-magnitude confidentiality and integrity impact with no availability impact - the combination of UI:R, scope change (S:C) and C:L/I:L is the canonical Oracle fingerprint for a cross-site scripting (XSS) class vulnerability in a web component, which aligns with the 'Web Runtime SEC' component name. No EPSS score, CISA KEV entry, or public POC was supplied in the intelligence set, so there is no evidence of active or probable exploitation; absence of these signals is not proof of safety but does argue against widespread automated attack. The practical ceiling on risk is the user-interaction requirement: an attacker cannot compromise the system unassisted and must lure an authenticated/active user into triggering the payload. Note the input Tag 'Authentication Bypass' does not match the CVSS profile or description - the data indicates an XSS/injection-style web flaw, not an auth bypass; treat that tag as suspect and verify against Oracle CPU October 2026. Overall: a legitimate patch-in-normal-cycle item, elevated slightly by unauthenticated network reach and scope change, but bounded by UI:R and low impact.

An attacker crafts a malicious HTTP link or input that, when a logged-in JD Edwards EnterpriseOne Tools user opens or interacts with it, injects script into the Web Runtime context and executes in the victim's browser session. This lets the attacker read a subset of accessible data and perform some unauthorized update/insert/delete actions as the victim, with impact potentially crossing into other products due to the scope change. No public exploit code was identified at time of analysis, and success depends on convincing a legitimate user to take the interaction.