Oracle JD Edwards EnterpriseOne Tools CVE-2026-91287

Exploitation requires the attacker to have access to the physical communication segment (adjacent/local network, AV:A) attached to the hardware running JD Edwards EnterpriseOne Tools - it cannot be triggered from an arbitrary remote/internet location. Within that constraint there are no further barriers: the attacker is unauthenticated (PR:N), needs no user interaction (UI:N), and attack complexity is low (AC:L), affecting the Enterprise Infrastructure SEC component on supported versions 9.2.0.0 through 9.2.26.5. The primary limiting factor defenders should weigh is network adjacency - segmentation, VLAN isolation, and restricting untrusted devices on the EnterpriseOne host's segment substantially reduce realistic exposure; organizations with flat or shared internal networks have a correspondingly higher risk.

This is a genuinely serious vulnerability (CVSS 3.1 base 8.1) but one whose real-world risk is materially constrained by its attack vector. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N confirms low complexity, no privileges and no user interaction - meaning that any attacker who reaches the network is unauthenticated and can act trivially - with high confidentiality and integrity impact (full read and create/delete/modify of all JD Edwards EnterpriseOne Tools accessible data) but no availability impact. The critical mitigating signal is AV:A (Adjacent), which both the vector and the description reinforce: the attacker must have access to the physical communication segment attached to the hardware running the product. This is NOT a remotely internet-exploitable (AV:N) bug, so mass or automated internet-wide exploitation is not the realistic threat model. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no current evidence of active exploitation or weaponization - this appears to be a standard Oracle Critical Patch Update disclosure rather than an emergency. Net assessment: high priority for internal patching on hosts where untrusted devices can share the local segment (flat networks, shared data-center VLANs, insider/compromised-host scenarios), but the adjacency requirement legitimately lowers it below an internet-facing unauthenticated RCE. Note one point to verify: the 'Authentication Bypass' tag is not corroborated by the description, which describes unauthenticated adjacent access rather than an explicit bypass of an auth mechanism - treat the tag cautiously.

An attacker who has gained a foothold on the same local network segment as the JD Edwards EnterpriseOne Tools host - for example via a compromised workstation, rogue device, or lateral movement onto a shared data-center VLAN - sends crafted traffic to the Enterprise Infrastructure SEC component without any credentials or user interaction. Because attack complexity is low and no authentication is required, they obtain full read access to all EnterpriseOne-accessible data and can create, delete, or modify critical ERP records. No public exploit code is identified at time of analysis, so exploitation would require the attacker to develop their own tooling.