JD Edwards EnterpriseOne CVE-2026-91305

No special conditions - remote unauthenticated exploitation over HTTPS against the Installation Security component of Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. The only prerequisite is network reachability to the EnterpriseOne Tools HTTPS interface; no credentials, no privileged role, and no user interaction are required (PR:N/UI:N). The practical limiting factor is exposure: environments that keep the EnterpriseOne Tools web interface behind a VPN or restricted to internal networks sharply reduce the attack surface, whereas internet-exposed instances are directly at risk. Availability is unaffected (A:N), so exploitation targets data confidentiality and integrity rather than service uptime.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst practical combination for pre-exploitation: network-reachable over HTTPS, low attack complexity, no privileges, and no user interaction. Oracle's own text ('Easily exploitable') reinforces the AC:L rating. The impact is C:H/I:H with A:N, meaning an attacker gains full read and full create/delete/modify access to all JD Edwards EnterpriseOne Tools data but cannot directly affect availability - consistent with a data-compromise/authentication-bypass issue rather than a crash/DoS. Signals that are MISSING and limit certainty: no EPSS probability was provided, the CVE is NOT in CISA KEV, no public POC is referenced, and CWE is listed as N/A. The only reference is the Oracle October 2026 Critical Patch Update advisory, so exploitation evidence is absent. The 'Authentication Bypass' tag aligns with PR:N and the description's 'unauthenticated attacker' language, strengthening confidence that no credentials are required. Net: treat as urgent patching priority given unauthenticated network RCE-equivalent data access on an ERP system, while noting that no active-exploitation or EPSS data exists to confirm real-world weaponization yet.

An attacker with network reach to the JD Edwards EnterpriseOne Tools HTTPS interface sends crafted requests that bypass authentication in the Installation Security component, then reads and arbitrarily creates, modifies, or deletes any data the application can access. Because no credentials, user interaction, or special privileges are needed, exploitation is feasible for any party who can reach the exposed endpoint. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's description rather than demonstrated POC code.