JD Edwards EnterpriseOne CVE-2026-91289

Exploitation requires the attacker to have access to the physical/adjacent communication segment attached to the hardware running JD Edwards EnterpriseOne Tools (AV:A) - it is NOT exploitable over a routed/internet path - and it specifically targets the Monitoring and Diagnostics SEC component. No credentials or user interaction are needed (PR:N/UI:N), but the attack is of high complexity (AC:H / Oracle 'difficult to exploit'), meaning success depends on conditions outside the attacker's direct control. Limiting factors that reduce realistic risk: the requirement for local/adjacent network presence, the high technical bar, and the confidentiality-only impact (no integrity or availability effect). Affected deployments are EnterpriseOne Tools 9.2.0.0 through 9.2.26.5.

This is a medium-severity issue (CVSS 3.1 base 5.3) whose real-world risk is substantially constrained by its access model. The vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N shows that although no authentication is required (PR:N), the attacker must sit on the adjacent/physical communication segment attached to the host running JD Edwards EnterpriseOne Tools (AV:A) and must overcome high exploitation complexity (AC:H), which Oracle characterizes as 'difficult to exploit.' Impact is confidentiality-only (C:H/I:N/A:N): it can expose all JD Edwards-accessible data but cannot modify data or affect availability. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis. The signals are internally consistent - a high-impact-to-confidentiality but hard-to-reach flaw - meaning this is a genuine but lower-priority item for most environments: prioritize it where the EnterpriseOne host shares an untrusted local network segment, and deprioritize where it sits on a well-segmented management network. Note the 'Authentication Bypass' input tag does not match the described behavior (unauthenticated adjacent-network data disclosure, not a bypass of an authentication control) - treat that tag with caution.

An attacker who has already gained a foothold on the same local/adjacent network segment as the JD Edwards EnterpriseOne Tools host (e.g., a compromised server, rogue device, or insider on the LAN) targets the Monitoring and Diagnostics SEC component without needing credentials. By carrying out a technically difficult (AC:H) adjacent-network attack, they read sensitive EnterpriseOne data up to and including all data the Tools layer can access. No public exploit code is identified at time of analysis, so this would require original exploit development.