JD Edwards EnterpriseOne CVE-2026-91327

Exploitation requires the attacker to be positioned on the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools runs (CVSS AV:A, Adjacent) - remote internet-based exploitation is not possible. No authentication is required (PR:N) and no user interaction is needed (UI:N), but Attack Complexity is High (AC:H), meaning success depends on conditions outside the attacker's control. The principal limiting factors are therefore network adjacency (the server's local segment must be reachable and ideally isolated) and the high-complexity precondition; any network segmentation that isolates EnterpriseOne Tools hosts materially reduces exposure. Affected deployments are supported versions 9.2.0.0 through 9.2.26.5.

This is a genuinely lower real-world priority than its 7.5 (High) CVSS base score might suggest, driven by two strong limiting factors in the vendor-supplied vector. The attack vector is Adjacent (AV:A) - the description explicitly requires the attacker to have access to the physical communication segment attached to the hardware running JD Edwards EnterpriseOne Tools - so this is not remotely exploitable across the internet. Attack Complexity is High (AC:H), indicating the attack depends on conditions outside the attacker's control. These two factors substantially offset the otherwise severe PR:N (no authentication) and full C:H/I:H/A:H (complete takeover) impact. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so there is no evidence of active or probable exploitation; the signals are consistent with a theoretical-but-serious flaw rather than an imminently exploited one. The one notable conflict is in the metadata: the 'Information Disclosure' tag understates the impact, since the description and vector describe full takeover (I:H/A:H), not merely confidentiality loss. Net assessment: patch in the normal Oracle CPU cycle rather than as an emergency, with priority weighted by how exposed the host's local network segment is.

An attacker who has already gained a foothold on the same physical/local network segment as a JD Edwards EnterpriseOne Tools host (e.g., via a compromised adjacent device or insider access to the server VLAN) exploits the Installation Security weakness without needing credentials, ultimately taking over the EnterpriseOne Tools instance. The High attack complexity means the attacker must satisfy conditions outside their control (such as timing or specific network state), so success is not guaranteed. No public exploit code has been identified at the time of analysis.