Oracle JD Edwards EnterpriseOne Tools: Authorization flaw in Web Runtime SEC

Summary

A vulnerability in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools affects supported versions 9.2.0.0 through 9.2.26.5. An authenticated attacker with low privileges and network access via HTTP can compromise the product, with high impact on confidentiality, integrity and availability. No user interaction is required. The vulnerability is classified under CWE-284 (Improper Access Control), and the NVD analysis is still pending.

Affected

• Oracle JD Edwards EnterpriseOne Tools, supported versions 9.2.0.0 through 9.2.26.5
• Component: Web Runtime SEC
• CVSS 3.1: 8.8 (High), CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed in

Unknown. Check the JD Edwards section of the Oracle Critical Patch Update of October 2026 and the corresponding Tools patch in My Oracle Support for the exact fixed release for your 9.2 tools level.

Workaround

Unknown. No Oracle-issued workaround has been confirmed. A third-party source suggests restricting inbound HTTP/HTTPS traffic to the Web Runtime SEC component to trusted IP ranges until patched, and enabling detailed logging with monitoring. This is generic advice, not Oracle guidance.

Exploitation

• No known exploitation in the wild found.
• Not listed in the CISA KEV catalogue (per OpenCVE).
• No public proof-of-concept found; this has not been exhaustively verified.
• EPSS score of 0.00328 (low predicted probability).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Identify whether JD Edwards EnterpriseOne Tools 9.2 is in use and whether its web tier is exposed to the internet or to broad partner or VPN networks.
• Apply the fixed Tools release from Oracle's October 2026 CPU as soon as it is confirmed; prioritise internet-facing systems.
• Until patched, restrict HTTP/HTTPS access to trusted networks and enable detailed logging with monitoring.
• Prioritise CVE-2026-91299 (CVSS 10.0, JD Edwards EnterpriseOne Orchestrator) from the same advisory.
• Monitor CISA KEV and Oracle channels for exploitation reports and recheck the NVD entry.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Security Alert: Critical Patch Update October 2026 www.oracle.com
• OpenCVE: CVE-2026-91268 app.opencve.io
• Strix: CVE-2026-91268 www.strix.ai
• Vulners: CVE-2026-91268 vulners.com
• eSecurityPlanet: Oracle October 2026 Critical Patch Update www.esecurityplanet.com
• Waratek: Oracle October 2026 Critical Patch Update waratek.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:33.