JD Edwards EnterpriseOne CVE-2026-91315

Exploitation targets the Installation Security component of JD Edwards EnterpriseOne Tools and requires the attacker to already have a local logon on the host where EnterpriseOne Tools executes (AV:L) - it is not remotely reachable over the network. It additionally requires human interaction from a person other than the attacker (UI:R), i.e. a victim user or administrator must perform an action (such as an installation or maintenance operation) for the attack to succeed. These two limiting factors - local access plus required victim interaction - substantially narrow realistic exploitation to multi-user/shared JDE hosts despite the PR:N vector label. Only versions 9.2.0.0 through 9.2.26.5 are affected.

This is a genuine but situationally-constrained high-severity issue rather than a mass-exploitation emergency. The CVSS 3.1 base score of 7.8 is driven entirely by impact (C:H/I:H/A:H, full product takeover) combined with low attack complexity, NOT by remote reach: the vector is AV:L (local) and UI:R (requires human interaction from someone other than the attacker). Although the vector lists PR:N, Oracle's own description qualifies this as an 'unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes' - meaning the attacker needs an existing foothold/session on the host, which materially reduces real-world exploitability versus a network-facing flaw. No EPSS score, CISA KEV listing, SSVC decision, or POC was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The dependency on local access plus victim interaction makes this a priority for timely patching on multi-user JD Edwards hosts, but it is not a 'drop everything' internet-exploitable bug. Note a signal conflict to verify: the vector says PR:N (unauthenticated) while the prose implies the attacker must already be able to log on to the infrastructure - treat the auth bar as 'requires local host access' pending vendor clarification.

An attacker who already has a local logon on a server hosting JD Edwards EnterpriseOne Tools plants or stages a malicious artifact exploiting the Installation Security component. A separate, higher-privileged user (such as an administrator performing an installation or maintenance task) then interacts with it, triggering code execution that results in full takeover of the EnterpriseOne Tools instance. No public exploit code is identified at this time.