Oracle JD Edwards EnterpriseOne Tools: Missing authentication in Interoperability SEC
Summary
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 contain a missing authentication flaw (CWE-306) in the Interoperability SEC component. An unauthenticated attacker with network access to the SOAP interface can gain unauthorized access to data accessible through JD Edwards EnterpriseOne Tools, and the scope change may affect additional products. The CVSS 3.1 base score is 8.6 with high confidentiality impact only; NVD analysis is still pending.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (component: Interoperability SEC)
Fixed in
Unknown. Check Oracle's October 2026 Critical Patch Update for the fixed release.
Workaround
Unknown. The CVE record provides no workaround.
- Restrict network access to the SOAP interoperability endpoints to known internal clients (own recommendation, confirm with Oracle).
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV at the time of research.
- No public proof of concept found.
- CISA SSVC: Automatable yes, technical impact partial.
Our recommendation
- Identify all JD Edwards EnterpriseOne Tools installations at clients and record their exact versions.
- Apply the fixed release from Oracle's October 2026 CPU, together with the other JDE EnterpriseOne Tools fixes from the same CPU.
- Until patched, limit access to the SOAP interoperability services and make sure they are not exposed to the internet.
- Monitor NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- OpenCVE CVE-2026-91267 app.opencve.io
- Vulners CVE-2026-91267 vulners.com
- Strix CVE-2026-91267 www.strix.ai
- Vulners CVE-2026-91309 vulners.com
- Vulners CVE-2026-87314 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:28.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.