JD Edwards EnterpriseOne CVE-2026-91296

Exploitation requires no authentication (PR:N) and network access over HTTP against JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5, specifically the Enterprise Infrastructure SEC component. The decisive limiting factor is required human interaction (UI:R): a legitimate user other than the attacker must be induced to interact (e.g., follow a crafted link or load attacker-supplied content) before the attack succeeds - the vulnerability cannot be triggered autonomously by the attacker alone. No special non-default configuration is cited by Oracle, so default deployments of the affected versions are considered exploitable once a user is lured; the dependence on victim interaction is what constrains real-world exploitation despite the unauthenticated network vector.

This is a genuine high-priority vulnerability, though not the top of the triage stack absent exploitation signals. The CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring no attacker privileges (PR:N, so unauthenticated) but gated by required user interaction (UI:R), with high impact to all of confidentiality, integrity, and availability - consistent with Oracle's 'takeover' language. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis. The signals are therefore internally consistent (a serious but not-yet-exploited bug) rather than conflicting. The single mitigating factor is UI:R: successful attacks require a legitimate user (someone other than the attacker) to take an action, which lowers real-world likelihood versus a fully autonomous AV:N/UI:N flaw. Note the input 'Information Disclosure' tag is inconsistent with the full C:H/I:H/A:H takeover impact described, so treat that tag as unreliable. Because this ships in Oracle's October 2026 Critical Patch Update, patch availability is confirmed and prioritized remediation is warranted for internet-exposed or user-accessible JD Edwards EnterpriseOne Tools instances.

An unauthenticated attacker crafts a malicious HTTP request or lure (e.g., a crafted link or page targeting the Enterprise Infrastructure SEC component) and induces a legitimate JD Edwards user to interact with it. That interaction triggers the flaw in the user's session/context, resulting in full compromise (takeover) of JD Edwards EnterpriseOne Tools. No public proof-of-concept exploit is identified at time of analysis.