JD Edwards EnterpriseOne CVE-2026-91310

Exploitation requires network reachability to the JDENET communication service and possession of a valid low-privileged account on JD Edwards EnterpriseOne Tools (CVSS PR:L) - it is NOT unauthenticated. The flaw resides in the Installation SEC component and affects EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5; environments on later patched builds are not exposed. Limiting factors: the attacker must already authenticate at a low privilege level, and JDENET must be network-accessible to the attacker (direct internet exposure, or lateral access from within the enterprise network, materially raises real risk). No specific non-default configuration is named by Oracle, and no user interaction is required (UI:N).

This is a credible operational priority rather than an inflated high-CVSS score. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise - i.e., complete takeover of JD Edwards EnterpriseOne Tools. The 'easily exploitable' language from Oracle reinforces the AC:L rating. However, several real-world risk signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no indication of public exploit code or an SSVC decision point, so active-exploitation and automatability cannot be assessed from the data provided. The PR:L requirement meaningfully constrains risk - an attacker must already hold a valid low-privileged JDENET account or session, so this is a privilege-escalation/post-authentication takeover rather than fully unauthenticated RCE. One inconsistency to flag: the 'Information Disclosure' tag understates the impact, since the description and the C:H/I:H/A:H vector indicate full product takeover, not mere disclosure - verify impact classification against the Oracle CPU advisory. Net: treat as high priority for any internet- or widely-reachable JDENET deployment, but note that exploitation probability data is absent, so prioritization leans on the strong CVSS vector plus vendor 'easily exploitable' framing rather than observed exploitation.

An attacker who holds or phishes low-privileged credentials for a JD Edwards EnterpriseOne environment connects over the network to the JDENET service and sends crafted requests that abuse a flaw in the Installation SEC component. Because attack complexity is low and no user interaction is needed, the attacker escalates to full control of the EnterpriseOne Tools layer, enabling data theft, tampering, and service disruption. No public exploit identified at time of analysis, so exploitation currently requires original development or reverse-engineering of the Oracle October 2026 patch.