JD Edwards EnterpriseOne CVE-2026-91286

Exploitation requires the attacker to be positioned on the physical/adjacent network communication segment attached to the hardware running JD Edwards EnterpriseOne Tools (CVSS AV:A) - it is NOT reachable over the public internet or routed networks. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the vulnerable surface is the Monitoring and Diagnostics SEC component in Tools versions 9.2.0.0 through 9.2.26.5. The scope change (S:C) means impact can extend beyond JDE Tools to additional connected products. The primary limiting factor is the adjacent-network prerequisite: defenders who segment and tightly control the VLAN/subnet hosting JDE servers materially reduce exposure, as an attacker must already have local network access.

The CVSS 3.1 base score of 8.2 (High) is driven largely by the scope change (S:C), unauthenticated access (PR:N), and high confidentiality impact (C:H), but the single most important mitigating signal is the attack vector: AV:A (Adjacent). This is NOT a remotely internet-exploitable flaw - the Oracle description explicitly states the attacker needs 'access to the physical communication segment attached to the hardware' running JD Edwards EnterpriseOne Tools. That requirement confines exploitation to an attacker already positioned on the same local/adjacent network segment, substantially reducing real-world risk versus an equivalent AV:N vulnerability. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The score therefore reflects a high-impact but access-constrained issue rather than a mass-exploitation priority. Note a signal to verify: the input Tag 'Authentication Bypass' is not corroborated by the Oracle description, which characterizes the issue as unauthenticated adjacent-network access rather than a bypass of an authentication control - treat that tag with caution. Overall: a genuine high-severity issue warranting prompt patching for internally-reachable JDE hosts, but lower immediate urgency than its 8.2 implies for internet-facing exposure because adjacent-network positioning is a hard prerequisite.

An attacker who has already gained a foothold on the same local network segment as a JD Edwards EnterpriseOne Tools server (for example via a compromised workstation or rogue device in the data-center VLAN) sends crafted traffic to the Monitoring and Diagnostics SEC component without any credentials. Because the vulnerability carries a scope change, successful exploitation can expose critical JDE data and affect additional connected products. No public exploit code is identified at time of analysis, and the AV:A requirement means the attacker must first achieve adjacent-network positioning.