JD Edwards EnterpriseOne CVE-2026-91303

Exploitation requires that a user other than the attacker interact with attacker-supplied content (UI:R) - for example clicking a crafted link or opening a malicious page directed at the Installation Security component - so delivery depends on social engineering rather than a direct unauthenticated server hit. No authentication or prior privileges are needed (PR:N) and the vector is remote over HTTP (AV:N) against affected JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. The required human interaction is the primary limiting factor; there is no indication a non-default configuration is needed, but the mandatory victim interaction meaningfully reduces suitability for automated mass exploitation.

This is a credible high-priority vulnerability, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: an unauthenticated remote attacker over HTTP can achieve full compromise (takeover) of JD Edwards EnterpriseOne Tools with high confidentiality, integrity, and availability impact. The single meaningful brake is UI:R - successful attacks require interaction from a person other than the attacker, which shifts the realistic threat toward social-engineering/phishing-style delivery rather than fully automated mass exploitation. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only reference is the Oracle October 2026 Critical Patch Update advisory. Note a signal conflict worth resolving: the input Tags label this 'Information Disclosure,' but the description and CVSS (C:H/I:H/A:H plus explicit 'takeover') describe full system compromise, not mere disclosure - treat the 'Information Disclosure' tag as understating the impact. Overall: genuinely dangerous if a user can be lured into interacting, but the UI requirement and absence of known exploitation argue for prompt patching rather than panic.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the Installation Security component and uses phishing or a watering-hole page to get a legitimate user (an administrator or operator) to interact with it. When the victim opens the crafted content, the flaw is triggered in the context of JD Edwards EnterpriseOne Tools, resulting in full takeover. No public exploit code was identified at time of analysis, and exploitation hinges on the required human interaction.