JD Edwards EnterpriseOne CVE-2026-91325

Exploitation requires network reachability to a JD Edwards EnterpriseOne Tools instance (versions 9.2.0.0 through 9.2.26.5) over HTTP, specifically its Installation Security component; per CVSS PR:N/UI:N no authentication or user interaction is needed. The primary LIMITING factor is exposure: JD Edwards EnterpriseOne is typically an internally deployed ERP, so instances not reachable from an attacker's network position (e.g., not internet-facing, segmented behind a VPN) are not exploitable by external actors. Impact is further limited to confidentiality (C:H, I:N, A:N) - an attacker gains read access to data but cannot modify records or disrupt availability.

This is a genuinely high-priority vulnerability by its exploitability profile, though impact is bounded to confidentiality only. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case access profile: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction required - Oracle itself labels it 'easily exploitable.' The C:H/I:N/A:N split means a successful attack yields unauthorized access to all JD Edwards EnterpriseOne Tools-accessible data but no integrity or availability impact, which is why the score caps at 7.5 (High) rather than Critical. Key real-world exploitation signals are MISSING from the provided data: there is no EPSS score, no CISA KEV listing, and no POC indicator, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag aligns with the PR:N/C:H profile (an unauthenticated actor reaching protected data), but the specific bypass mechanism in the 'Installation Security' component is not described. Bottom line: treat this as a real patch priority because of the trivial exploitability against an enterprise ERP, but note that the absence of EPSS/KEV/POC data means widespread active exploitation is not currently evidenced - prioritization should rest on exposure (internet-facing JDE Tools instances) rather than on a confirmed exploitation signal.

An unauthenticated attacker who can reach a JD Edwards EnterpriseOne Tools instance over the network sends crafted HTTP requests to the vulnerable Installation Security component, bypassing authentication controls to read critical application data. Because the flaw requires no credentials, no user interaction, and low complexity, exploitation is straightforward against any exposed instance, though impact is limited to information disclosure (no data modification or service disruption). No public exploit code is identified in the provided data.