CVE-2026-91265

Summary

The JD Edwards EnterpriseOne Tools product has a vulnerability in its Enterprise Infrastructure SEC component that allows unauthenticated attackers to bypass authentication and gain unauthorized access to critical data or modify it, due to missing or improper authentication checks.

Exploitability

This is an easily exploitable vulnerability requiring no authentication or user interaction, with only network access via HTTP needed.

Blast radius

Successful exploitation could lead to full compromise of confidentiality and integrity of all JD Edwards EnterpriseOne Tools accessible data, potentially affecting business-critical ERP operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to JD Edwards EnterpriseOne Tools version 9.2.26.6 or later, as this is the first supported version that addresses the vulnerability in component Enterprise Infrastructure SEC.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.