JD Edwards EnterpriseOne Tools CVE-2026-91290

Exploitation requires the attacker to already have a valid low-privileged account with logon access to the infrastructure where JD Edwards EnterpriseOne Tools executes (AV:L, PR:L), targeting the Web Runtime SEC component on affected versions 9.2.0.0 through 9.2.26.5. Limiting factors: no remote/network vector (local logon needed), existing authentication is a prerequisite, and impact is confined to unauthorized data disclosure - there is no integrity or availability impact (I:N/A:N) and no user interaction is involved. Oracle does not disclose a specific configuration toggle, so the condition is the authenticated-logon prerequisite itself rather than a non-default setting.

This is a moderate-priority issue that does not rise to an urgent patch-now item on the exploitation signals alone. The Oracle-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally exploitable, low-complexity flaw requiring an already-authenticated low-privileged account, with impact limited to confidentiality (C:H; I:N/A:N means no data tampering or denial of service). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is a notable conflict between the metadata and the technical data: the input carries an 'Authentication Bypass' tag, yet the CVSS vector (PR:L) and the description ('low privileged attacker with logon') both require valid authenticated access - this is an authenticated information-disclosure flaw, not an authentication bypass, so the tag appears mislabeled and should be verified against Oracle's CPU October 2026 advisory. Net: a real but not critical confidentiality exposure in a sensitive enterprise ERP component, best triaged within a normal Oracle Critical Patch Update cycle rather than as an emergency.

An attacker who already holds a low-privileged JD Edwards EnterpriseOne Tools account (or who has compromised one via phishing or credential reuse) logs in to the infrastructure hosting the application and abuses the Web Runtime SEC component to read data they are not authorized to see, up to all data accessible to the application. No public exploit code is known, and exploitation requires existing authenticated local access, which limits opportunistic use.