EnterpriseOne Tools CVE-2026-91302

Exploitation requires the attacker to already hold a valid local logon on the infrastructure where JD Edwards EnterpriseOne Tools runs (AV:L), and success additionally depends on interaction from a different legitimate user (UI:R) - the attacker cannot complete the attack alone. The affected component is specifically the Enterprise Infrastructure SEC component of EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. These two factors - mandatory local foothold and required third-party human interaction - are the primary limiters and are the reason real-world impact is confined to a partial availability degradation (A:L) with no confidentiality or integrity effect; there is no remote, unauthenticated, or default-configuration exploitation path.

This is a genuinely low-priority issue, and the signals are consistent in that direction rather than conflicting. The CVSS 3.1 base score is only 3.3 (LOW), driven entirely by a partial availability impact (A:L) with no confidentiality or integrity consequence (C:N/I:N). The vector is local (AV:L), requires user interaction from a third party (UI:R), and has unchanged scope (S:U), which collectively make opportunistic or remote mass-exploitation implausible. No EPSS score was supplied in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation status is: no public exploit identified at time of analysis. One internal inconsistency in the Oracle source phrasing should be flagged explicitly: the description states an 'unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes,' which combines PR:N (no application authentication) with a requirement for local OS logon access - the PR:N metric reflects lack of app-level privileges, but a valid local session is still needed, so defenders should treat this as requiring some foothold rather than truly anonymous access. Verify this nuance with Oracle's CPU October 2026 advisory. Bottom line: low real-world risk - a non-priority patch suitable for normal maintenance cycles, not emergency remediation.

An attacker who already has local logon access to a host running JD Edwards EnterpriseOne Tools crafts input or an action that, once a separate legitimate user interacts with it, causes a partial denial of service of the EnterpriseOne Tools component. No code execution or data disclosure results - only a degradation or interruption of availability. No public exploit code is known, and the local-access plus required third-party interaction significantly constrain practical abuse.