JD Edwards EnterpriseOne CVE-2026-91304

Exploitation requires the attacker to already have local logon access to the infrastructure (host/OS) where JD Edwards EnterpriseOne Tools executes (AV:L), targeting the Installation Security component. It additionally requires human interaction from a person other than the attacker (UI:R) - typically a legitimate operator or administrator performing an installation or configuration action - which is the primary limiting factor and prevents fully autonomous exploitation. No application-level authentication is needed (PR:N), and attack complexity is low (AC:L), but the local-access and victim-interaction prerequisites confine this to insider or post-foothold scenarios on affected versions 9.2.0.0 through 9.2.26.5.

This is a locally-exploitable flaw in Oracle JD Edwards EnterpriseOne Tools that, despite its 7.8 (High) CVSS, sits well below the priority of a network-facing critical. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals that an attacker needs local access to the infrastructure where the Tools component runs, and that success is gated on human interaction from a separate victim - both of which sharply narrow real-world exploitability versus a remote-unauthenticated bug. Oracle's phrasing is notable and partly conflicting: it calls the attacker 'unauthenticated' yet requires 'logon to the infrastructure where JD Edwards EnterpriseOne Tools executes,' which the vector reconciles as PR:N (no application privileges) combined with AV:L (local presence on the host) - verify the intended trust boundary with Oracle, as the 'unauthenticated' label can mislead triage. No EPSS score, CISA KEV listing, POC, or SSVC data was provided; absence of these is not evidence of safety, but there is no positive signal of active or imminent exploitation. On balance this is a genuine high-severity local privilege/takeover issue that enterprises running affected versions should patch in the normal Oracle CPU cycle, but it is not an emergency drive-by threat.

An attacker with a foothold on the server infrastructure hosting JD Edwards EnterpriseOne Tools (e.g., a low-privileged local account or a staged malicious installation artifact) leverages a weakness in the Installation Security component, then waits for or induces a legitimate administrator or operator to perform an action (such as running an installer or configuration step) that triggers the flaw, resulting in full takeover of the EnterpriseOne Tools environment. No public exploit identified at time of analysis, so this would currently require attacker-developed tooling. The local attack vector and required victim interaction make this a targeted, insider-or-post-compromise scenario rather than mass exploitation.