JD Edwards EnterpriseOne CVE-2026-91311

Exploitation requires interactive or local logon access to the server infrastructure where JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) runs, plus valid low-privileged credentials on that host (CVSS PR:L) - it cannot be triggered remotely over the network (AV:L) and needs no victim user interaction (UI:N). The specific feature is the Installation Security component. Limiting factors that reduce real-world risk: the attacker must already be authenticated on the host and have a local foothold, so the vulnerability is primarily relevant to insider threat or post-exploitation privilege escalation scenarios rather than unauthenticated remote attack; deployments where the EnterpriseOne Tools host is tightly access-controlled and single-tenant face materially lower exposure.

This is a genuine but operationally-bounded risk rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: exploitation requires local logon access to the infrastructure where JD Edwards EnterpriseOne Tools executes, needs only low privileges and low complexity, no user interaction, and yields full confidentiality, integrity and availability loss ('takeover'). The limiting factor is the local attack vector (AV:L) plus the PR:L authentication requirement - an attacker must already have a foothold and valid low-privileged credentials on the host, which substantially narrows the threat population to insiders or post-compromise lateral movement. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation; absence of these is not evidence of safety but means prioritization should rest on CVSS and asset exposure. Conflict to note: the input Tag 'Information Disclosure' understates the impact - the description states full takeover with C/I/A all High, so treating this as a read-only disclosure bug would misrepresent the risk. For organizations running affected JD Edwards EnterpriseOne Tools on shared or multi-user infrastructure, this warrants prompt patching in the Oracle October 2026 CPU cycle; for isolated single-admin deployments the local prerequisite lowers urgency.

An attacker who already holds low-privileged logon access to the server hosting JD Edwards EnterpriseOne Tools - for example a standard application operator account or a foothold gained through an unrelated compromise - abuses the Installation Security component locally to escalate to full control of the EnterpriseOne Tools instance. Because complexity is low and no user interaction is required, the step from low-privileged local access to complete takeover is straightforward. No public exploit code was identified in the provided data.