EnterpriseOne Tools CVE-2026-91329

Exploitation requires THREE concurrent conditions drawn from Oracle's description: (1) the attacker must already possess an interactive logon on the infrastructure/host where JD Edwards EnterpriseOne Tools runs (local access, AV:L); (2) a separate privileged person - not the attacker - must perform a human interaction, implied by the Installation Security component to be an installation or security-configuration operation (UI:R); and (3) the high attack complexity (AC:H) indicates additional non-trivial conditions or timing beyond the attacker's control must be met. These factors - local foothold, dependence on a second human actor, and high complexity - are the key limiters that reduce realistic risk well below what the 6.5 score alone suggests. It is NOT remotely exploitable and NOT exploitable against a default configuration without a privileged user action.

This is a moderate-severity issue (CVSS 6.1 base score stated as 6.5 by Oracle) whose real-world risk is substantially constrained by its exploitation preconditions. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H shows a LOCAL attack vector, HIGH attack complexity, and REQUIRED user interaction - three independent limiting factors that sharply reduce the likelihood of opportunistic or mass exploitation. Although PR:N technically marks it unauthenticated, Oracle's own description clarifies the attacker needs 'logon to the infrastructure where JD Edwards EnterpriseOne Tools executes,' meaning the attacker must already have a foothold on the host; this is captured by AV:L rather than PR, and the apparent tension between 'unauthenticated' (PR:N) and 'logon to the infrastructure' should be noted when prioritizing. No EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. Overall this is a high-CVSS-impact-but-low-real-world-likelihood issue for most defenders: the I:H/A:H (complete DOS plus critical-data modification) impact justifies patching in the normal Oracle CPU cycle, but the local vector, high complexity, and dependency on tricking a separate privileged user make widespread exploitation unlikely. Patch it on the standard Oracle Critical Patch Update schedule rather than as an emergency.

An attacker who has already obtained an interactive logon to a server hosting JD Edwards EnterpriseOne Tools plants a crafted local condition and then relies on a legitimate administrator or operator (a person other than the attacker) to perform an installation or security operation that triggers the flaw. The successful trigger lets the attacker modify or destroy critical EnterpriseOne data, read a subset of data, or force a complete denial of service. No public exploit code is known, and the high attack complexity means the attacker must reliably win a race or satisfy specific local conditions.