JD Edwards EnterpriseOne CVE-2026-91297

Exploitation requires human interaction from a user other than the attacker (CVSS UI:R): a victim must open or interact with an attacker-crafted HTTP request/link handled by the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. No attacker authentication is needed (PR:N), but the need for a victim to act - typically an authenticated operator accessing the affected interface - is the primary limiting factor, confining impact to that user's session and the data it can reach. The scope change (S:C) means successful script execution can affect resources beyond the vulnerable component.

This is a moderate-severity issue (CVSS 3.1 base 6.1) whose signals point to a cross-site-scripting-class flaw rather than a drop-everything priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N is the canonical pattern Oracle assigns to XSS: network-reachable and low-complexity with no attacker privileges, but gated by required human interaction (UI:R) and limited to Low confidentiality and Low integrity impact with a scope change (S:C) reflecting script execution in a victim's authenticated browser context. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The dependence on tricking a privileged human into interacting with attacker-controlled content, plus the absence of availability impact and the only partial C/I impact, means real-world risk is meaningfully lower than the raw score suggests. Note a conflict worth flagging: the input Tag 'Authentication Bypass' is not supported by the description or the CVSS vector, which describe an interaction-driven data-exposure/manipulation flaw, not a bypass of authentication - treat that tag as suspect and verify against Oracle's October 2026 CPU advisory.

An attacker crafts a malicious URL or payload targeting the Monitoring and Diagnostics SEC component of JD Edwards EnterpriseOne Tools and lures an authenticated user to open it over HTTP. When the victim interacts with the content, attacker-controlled script executes in their session context (scope change), enabling limited unauthorized reading and modification of JD Edwards-accessible data. No public exploit code was identified in the provided data.