JD Edwards EnterpriseOne CVE-2026-91309

Exploitation targets the Interoperability (SEC) component of JD Edwards EnterpriseOne Tools and requires network access to its HTTPS interface; no authentication (PR:N) and no user interaction (UI:N) are required. The key LIMITING factor is high attack complexity (AC:H) - Oracle rates this 'difficult to exploit,' indicating success depends on conditions outside the attacker's control such as specific server state, timing, or configuration rather than default, repeatable conditions. Only versions 9.2.0.0 through 9.2.26.5 are affected, and impact is confined to unauthorized reading of data (no integrity or availability impact).

This is a moderate-severity, confidentiality-only flaw (CVSS 3.1 base 5.9) in Oracle JD Edwards EnterpriseOne Tools. The CVSS vector AV:N/AC:H/PR:N/UI:N is a mixed signal: it is network-reachable and requires no authentication or user interaction (which raises exposure), but AC:H means Oracle assesses successful exploitation as difficult, typically requiring specific timing, configuration, or conditions outside the attacker's control. Impact is limited to confidentiality (C:H, I:N, A:N) - an attacker could read critical data but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or imminent exploitation; exploitation status is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag is not corroborated by the description, which characterizes the issue as unauthorized data access by an unauthenticated attacker rather than a confirmed bypass of an authentication control - treat that tag with caution and verify against Oracle CPU October 2026 notes. Overall this is a real but not top-tier priority: patch on a normal cycle, prioritizing internet-exposed JD Edwards instances, but it does not carry the urgency of a KEV-listed or low-complexity RCE.

An unauthenticated attacker with network access reaches an internet- or intranet-exposed JD Edwards EnterpriseOne Tools Interoperability (SEC) HTTPS endpoint and sends specially crafted requests that, under the right conditions, coerce the service into disclosing sensitive business data it should not expose. Because the CVSS complexity is High (AC:H), the attack is not reliably repeatable and likely depends on timing or specific server state; no public exploit code is known at the time of analysis.