JD Edwards EnterpriseOne CVE-2026-91298

Exploitation requires a valid low-privileged authenticated account on JD Edwards EnterpriseOne Tools (PR:L) AND interaction from a second, separate user who must view/load the attacker's injected content (UI:R) - consistent with a stored/reflected cross-site scripting flaw in the Web Runtime SEC component. These two requirements are the key limiting factors: the attacker cannot act fully unauthenticated, and no impact occurs until a victim user (e.g., another operator or administrator) interacts, which prevents unattended automated mass exploitation. Affected deployments are JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; the scope change (S:C) means successful execution can affect products beyond the vulnerable component.

This is a moderate-severity issue (CVSS 3.1 base 5.4) whose vector - AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - is the canonical Oracle signature for a cross-site scripting (XSS) flaw: network-reachable, low complexity, but gated behind a low-privileged authenticated session (PR:L) AND human interaction from a different user (UI:R), with a scope change (S:C) and only low confidentiality/integrity impact and no availability impact. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' Net: this is a real but lower-priority issue - the PR:L + UI:R requirements substantially reduce automatability and make opportunistic mass exploitation unlikely, pushing it below internet-facing unauthenticated flaws in patch urgency. Note a conflict in the input: the 'Authentication Bypass' tag is inconsistent with the CVSS vector, which explicitly requires privileges (PR:L) and user interaction - the vector pattern points to XSS, not an auth bypass, so the tag appears mislabeled and should be verified against Oracle's CPU advisory.

A low-privileged authenticated JD Edwards EnterpriseOne user injects a crafted script payload into a field handled by the Web Runtime SEC component. When another user - such as an administrator or operator - later views the affected page, the script executes in their browser session, letting the attacker read a subset of data and perform unauthorized update/insert/delete actions in that victim's context, with impact extending to additional products due to the scope change. No public exploit code was identified at the time of analysis.