JD Edwards EnterpriseOne CVE-2026-91455

Exploitation requires an attacker to deliver a crafted HTTP request to the JD Edwards EnterpriseOne Tools web interface (component E1 Dev Platform Tech - UNIX) running an affected version (9.2.0.0-9.2.26.5), AND requires human interaction from a person other than the attacker - a legitimate user must be induced to interact with the malicious content for the attack to succeed. No attacker authentication is needed (PR:N), but the mandatory user-interaction step (UI:R) is the primary limiting factor, meaning the attacker cannot exploit the system directly without social engineering of a valid user. Impact is bounded to partial read of a subset of data and partial insert/update/delete of some accessible data, with no availability impact.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that should be treated as routine patch-cycle priority rather than an emergency. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, but exploitation is gated by required human interaction (UI:R) and yields only partial confidentiality and integrity impact (C:L/I:L) with no availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or imminent exploitation. The signals are internally consistent and point to a comparatively low real-world risk despite the 'unauthenticated' label, because the attacker cannot act without tricking a legitimate user. Note the input 'Authentication Bypass' tag conflicts with the actual CVSS/description, which describe a user-interaction-driven injection affecting data integrity/confidentiality, not a bypass of authentication - this tag appears mislabeled and should not drive prioritization.

An attacker crafts a malicious HTTP link or payload targeting the JD Edwards EnterpriseOne Tools web interface and lures a legitimate user into interacting with it (e.g., clicking the link). When the victim's browser or session processes the crafted request, it performs unauthorized read of a subset of data and unauthorized insert/update/delete on some accessible data within the victim's context. No public exploit code is identified at time of analysis, and no automated/self-propagating exploitation is indicated given the mandatory human interaction.