JD Edwards EnterpriseOne CVE-2026-91282

Exploitation targets the Portal SEC (security) component of JD Edwards EnterpriseOne Tools and requires only network access over HTTP to a reachable Portal instance; no authentication (PR:N) and no user interaction (UI:N) are needed, so default internet- or intranet-exposed Portals are in scope. The primary LIMITING factor is High attack complexity (AC:H): per CVSS, the attacker must overcome conditions beyond their control - such as specific configuration, environmental state, timing, or knowledge not readily obtainable - making reliable exploitation difficult. Affected deployments are restricted to EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; later/patched releases are not affected. Impact is limited to confidentiality (data disclosure) with no integrity or availability consequence.

This is a genuine but moderate-priority issue, best characterized as a high-CVSS-component-but-tempered-real-risk case. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows a network-reachable, unauthenticated vulnerability (PR:N) with no user interaction, which normally raises urgency - but the High attack complexity (AC:H) is the dominant limiting signal, consistent with Oracle's own wording 'Difficult to exploit.' Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read critical or all JD Edwards-accessible data but cannot modify data or affect availability. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code. No SSVC decision data was supplied. Net: a real, fix-worthy flaw for internet-exposed JD Edwards Portal deployments given PR:N, but the AC:H barrier and confidentiality-only scope place it below critical, unauthenticated-RCE-class issues. One caveat to verify: the input Tags label this 'Authentication Bypass,' while Oracle's description frames it as unauthorized data access via HTTP - confirm the exact mechanism with Oracle before treating it as a true auth-bypass.

An unauthenticated attacker with network access to an internet- or intranet-exposed JD Edwards EnterpriseOne Tools Portal sends crafted HTTP requests to the Portal SEC component to gain unauthorized read access to sensitive or all JD Edwards-accessible data. The High attack complexity means the attacker must satisfy conditions outside their direct control (e.g. timing, configuration, or information not readily available), so exploitation is non-trivial. No public exploit code is referenced, so a successful attack would require independent research or weaponization.