EnterpriseOne Orchestrator CVE-2026-91299

No special conditions - remote unauthenticated exploitation over HTTP against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5, targeting the E1 IOT Orchestrator Security component (CVSS AV:N/AC:L/PR:N/UI:N). The only practical limiting factor is network reachability of the Orchestrator's HTTP interface: deployments that expose the Orchestrator to untrusted networks (e.g. internet-facing or flat internal networks) are directly exploitable, whereas instances segmented behind strict network controls or restricted to trusted management networks substantially reduce exposure. The scope change (S:C) means a successful compromise is not contained to the Orchestrator and can affect additional connected EnterpriseOne products. Exploitation requires no authentication, no user interaction, and no non-default configuration per the vendor's 'easily exploitable' characterization.

This is a genuine top-priority vulnerability, not a high-CVSS paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 10.0) is maximal: network-reachable over HTTP, low attack complexity, no privileges, no user interaction, scope change, and full confidentiality/integrity/availability impact resulting in complete takeover of the JD Edwards EnterpriseOne Orchestrator. Oracle itself describes it as 'easily exploitable' by an unauthenticated attacker, which corroborates the AC:L/PR:N metrics. The scope change (S:C) is significant: Oracle warns attacks 'may significantly impact additional products,' meaning compromise can pivot beyond the Orchestrator itself. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no confirmed active exploitation - the urgency here rests on exploitability and impact rather than on observed in-the-wild activity. Conflicting signal to note: the input Tag 'Information Disclosure' understates the issue, which the description and vector show to be full takeover with integrity and availability impact, not merely data exposure; treat the tag as unreliable and rely on the CVSS vector. Because this is an Oracle Critical Patch Update finding, defenders should treat patch application as time-critical given the trivial exploitation profile, even absent KEV/EPSS data.

An unauthenticated attacker who can reach the Orchestrator's HTTP endpoint over the network sends a crafted request to the E1 IOT Orchestrator Security component, requiring no credentials, no user interaction, and only low complexity. The attacker gains full control of the Orchestrator and, due to the scope change, leverages that position to impact connected JD Edwards EnterpriseOne products and downstream systems. No public exploit code has been identified at time of analysis, but the 'easily exploitable' characterization implies reliable weaponization is feasible once details are known.