Oracle JD Edwards EnterpriseOne Tools CVE-2026-91295

Exploitation requires (1) network access to the HTTP interface of the JD Edwards EnterpriseOne Tools Enterprise Infrastructure (SEC) component, and (2) valid low-privileged credentials (PR:L) - this is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special non-default configuration is indicated by Oracle's description. Affected deployments are limited to EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. The principal limiting factor is the authentication requirement: an attacker must first obtain or possess a low-privilege application account, which constrains exploitation to insiders or attackers who have already gained a foothold or valid credentials.

This is a credible high-priority issue, though not a crisis. The CVSS 3.1 base score of 8.8 is driven by a strong vector: network attack vector (AV:N over HTTP), low attack complexity (AC:L), no user interaction (UI:N), and full C:H/I:H/A:H impact resulting in product takeover - mitigated only by the requirement for low-level privileges (PR:L). Oracle describes it as 'easily exploitable,' which aligns with AC:L/UI:N. However, several real-world risk signals are MISSING from the provided data: there is no EPSS exploitation-probability score, no SSVC decision data, no CISA KEV listing, and no evidence of public exploit code. Per precision rules, exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/POC does not lower the intrinsic severity but means there is no current evidence of active or widespread exploitation, so this should be prioritized as a high-severity patch-cycle item rather than an emergency zero-day response. One data conflict to note: the input Tag labels this 'Information Disclosure,' yet the description and CVSS vector (C:H/I:H/A:H, 'takeover') indicate full compromise, not mere disclosure - the tag understates the impact and should not be relied upon.

An attacker who already holds a low-privileged application account (e.g., a legitimate but limited JD Edwards EnterpriseOne Tools user) sends crafted HTTP requests to the Enterprise Infrastructure (SEC) component to escalate from limited access to full control of the EnterpriseOne Tools instance. Because the vector is network-based with low complexity and no user interaction, exploitation requires only valid low-level credentials and network reachability to the HTTP interface. No public exploit code has been identified at the time of analysis.