JD Edwards EnterpriseOne Tools CVE-2026-91314

Exploitation requires (1) the attacker to already hold a logon on the infrastructure/host where JD Edwards EnterpriseOne Tools executes (local attack vector, AV:L), and (2) human interaction from a person other than the attacker (UI:R) - e.g., an operator or administrator who opens or processes attacker-supplied content. Affected configurations are EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; the component is Installation Security. Limiting factors that reduce real-world risk: no remote network exploitation is possible, a second human victim must be tricked into interacting, and single-user hardened hosts with no untrusted local logins are largely out of scope. Note the input data does not specify the exact file type, feature, or installation action that triggers the flaw, so the precise user-interaction step cannot be named from available data.

This is a genuinely high-severity but NOT a high-urgency-at-this-moment issue. The CVSS 3.1 base score is 7.8 with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning full confidentiality, integrity, and availability compromise (product takeover) but gated behind a LOCAL attack vector and required user interaction. The local vector (AV:L) sharply limits blast radius compared to a network-exploitable flaw: the attacker must already have logon access to the infrastructure hosting JD Edwards EnterpriseOne Tools, and must additionally lure a separate person into an interaction (UI:R). There is NO CISA KEV listing and NO public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score, SSVC decision, or CWE was supplied, so automatability and real-world exploitation probability cannot be quantified from the input. A notable signal conflict exists: the CVSS vector encodes PR:N (unauthenticated) while the description states the attacker needs 'logon to the infrastructure where JD Edwards EnterpriseOne Tools executes' - these are reconcilable (the attacker has an OS/infrastructure login but no application-level JDE privileges, which is how Oracle scores many of these), but defenders should note the apparent tension. Net: treat as a standard-priority patch-cycle item (Oracle October 2026 CPU) for exposed/multi-user JDE hosts rather than an emergency, given local-only access plus required third-party interaction and absence of known exploitation.

An attacker with a low-privilege login on a server or terminal-services host where JD Edwards EnterpriseOne Tools runs stages a malicious file or crafted input, then induces a legitimate operator or administrator to open or process it, triggering the flaw and yielding full takeover of the EnterpriseOne Tools environment. Because the vector is local (AV:L) with low complexity (AC:L) but requires human interaction from a person other than the attacker (UI:R), the scenario depends on a shared/multi-user host and social engineering of a second party. No public proof-of-concept was identified in the provided data.