JD Edwards EnterpriseOne CVE-2026-91288

Exploitation requires network access to the JDENET communication protocol/service of JD Edwards EnterpriseOne Tools, specifically reaching the Interoperability SEC component; no authentication or user interaction is needed (PR:N/UI:N). The primary limiting factor is high attack complexity (AC:H) - Oracle explicitly labels it 'Difficult to exploit,' implying the attacker must satisfy conditions beyond simply sending a request (e.g., timing, specific server state, or defeating a mitigating control). Realistic exposure is further limited to environments running affected versions 9.2.0.0 through 9.2.26.5 where the JDENET service is reachable by the attacker; JD Edwards servers are commonly deployed on internal networks rather than the public internet, which constrains the practical attack surface. Availability is unaffected (A:N).

This is a genuinely impactful but not top-tier-urgent vulnerability. The CVSS 3.1 score of 7.4 is driven by high Confidentiality and Integrity impact (C:H/I:H) combined with network reach (AV:N) and no authentication requirement (PR:N), but it is tempered by high attack complexity (AC:H), which is why it does not score higher. The AC:H is significant: Oracle's language 'Difficult to exploit' typically means the attacker must win a race condition, defeat a non-trivial protection, or satisfy conditions outside their direct control, materially lowering real-world exploitability. No EPSS score, CISA KEV listing, or public POC is present in the provided data - so there is no public exploit identified at time of analysis, and no evidence of active exploitation. No SSVC decision data was supplied. Net: a credible threat to data confidentiality and integrity in exposed JD Edwards environments, but the AC:H barrier and absence of exploitation signals place it below internet-facing, low-complexity, unauthenticated RCE bugs in priority. CWE is listed as N/A and no independent advisory beyond the Oracle CPU bundle is available, so the precise flaw mechanism is unconfirmed.

An attacker with network reach to the JDENET service port of an exposed JD Edwards EnterpriseOne Tools server sends specially crafted requests to the Interoperability SEC component without any credentials, exploiting a difficult-to-trigger flaw to read or tamper with critical ERP data. Because attack complexity is high, success likely requires precise timing or specific runtime conditions rather than a simple single-shot request. No public exploit code is known to exist at time of analysis.