EnterpriseOne Tools CVE-2026-91307

Exploitation requires network reachability to the JD Edwards EnterpriseOne Tools layer specifically over Oracle Net (the Oracle database networking protocol/listener), targeting the Installation Security component on affected Tools versions 9.2.0.0 through 9.2.26.5. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special non-default configuration are required to achieve unauthorized access to critical data. The principal limiting factor is the Oracle Net exposure requirement: environments that restrict Oracle Net/listener access to trusted network segments or do not expose it to untrusted networks substantially constrain who can reach the vulnerable surface, so practical risk depends heavily on network segmentation rather than on any application-level precondition.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with an information-disclosure/unauthorized-data-access weakness rather than code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on the CVSS signal alone, which is not corroborated by any exploitation-probability data. One notable tension: the vendor-supplied vector is self-consistent (AV:N via Oracle Net), but the description specifies exploitation 'via Oracle Net', which implies reachability of the database/listener network layer rather than a public web endpoint - organizations that do not expose Oracle Net beyond trusted network segments materially reduce exposure, so the AV:N rating may overstate practical reach in well-segmented deployments. Overall this is a genuinely serious confidentiality issue worth prioritized patching for internet- or broadly-reachable JD Edwards installations, but in the absence of EPSS/KEV/POC corroboration it is a high-CVSS issue without confirmed widespread exploitation, and the 'via Oracle Net' constraint should be verified against each environment's network exposure before treating it as remotely trivial.

An unauthenticated attacker with network access to the JD Edwards EnterpriseOne Tools layer via Oracle Net sends crafted traffic to the vulnerable Installation Security component and obtains unauthorized access to critical application data, potentially reading all data accessible to the EnterpriseOne Tools instance. No authentication, user interaction, or special preconditions are required per the CVSS vector, though network reachability of the Oracle Net service is a practical prerequisite. No public proof-of-concept exploit was provided in the input.