JD Edwards EnterpriseOne CVE-2026-91300

Exploitation targets the Web Runtime SEC component of JD Edwards EnterpriseOne Tools (supported versions 9.2.0.0-9.2.26.5) reachable over HTTP. It requires human interaction from a person other than the attacker (UI:R) - a victim must be induced to interact with attacker-supplied content - and the vulnerability is rated difficult to exploit (AC:H), meaning conditions outside the attacker's control must be met. These factors substantially limit realistic exploitation: no code execution, no data disclosure, and no availability impact are possible; the impact is confined to unauthorized update, insert, or delete of a subset of accessible data. No authentication is required (PR:N), so the attacker needs no credentials, but the mandatory user interaction and high complexity are the primary limiting factors defenders should weigh.

This is a low-severity issue (CVSS 3.1 base 3.1) and the signals consistently point to low real-world priority rather than a high-CVSS-but-overrated case. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) shows that although the attack is network-reachable and requires no authentication, it carries high attack complexity (AC:H) and mandatory user interaction (UI:R), with impact limited to low integrity (unauthorized update/insert/delete of some data) and no confidentiality or availability impact. EPSS is not provided in the input, the CVE is not listed in CISA KEV, and no POC or exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. There are no strongly conflicting signals; the main caveat is the input Tag 'Authentication Bypass,' which does not match the described vulnerability (an integrity-only flaw requiring victim interaction, not a bypass of authentication) - treat that tag as suspect. Overall this is a defensible patch-in-normal-cycle item, not an emergency.

An unauthenticated attacker crafts malicious content or a request targeting the Web Runtime SEC component of JD Edwards EnterpriseOne Tools and lures a legitimate user into interacting with it (e.g., clicking a crafted link or loading attacker-influenced content). Because of the high attack complexity and required user interaction, successful exploitation is difficult and yields only unauthorized update, insert, or delete access to a subset of application data. No public exploit code is identified at time of analysis.