Oracle JD Edwards EnterpriseOne Tools: Compromise via HTTP in Monitoring and Diagnostics
Summary
A flaw in the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, can be exploited over HTTP. An attacker with a low-privileged account and network access can take over the product, with high impact on confidentiality, integrity and availability (CVSS 8.8). The record lists no user interaction as required. Oracle published the fix in its October 2026 Critical Patch Update.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5
- Component: Monitoring and Diagnostics SEC
Fixed in
- Fixed in the Oracle October 2026 Critical Patch Update. Specific patch numbers: Unknown.
Workaround
- Unknown from the official advisory. Third-party sources suggest restricting HTTP access to the Monitoring and Diagnostics functions with firewall rules or VPNs, and limiting logon rights on the servers hosting the tools.
Exploitation
- Not listed in CISA KEV at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or exploitation reports found; search coverage was limited.
Our recommendation
- Check whether JD Edwards EnterpriseOne Tools 9.2.x is deployed.
- Apply the Oracle October 2026 CPU to affected installations, prioritising systems reachable beyond the internal network.
- Restrict HTTP access to the tools to trusted networks and review user accounts with valid logins.
- Check whether JD Edwards EnterpriseOne Orchestrator is deployed, as CVE-2026-91299 is a separate critical flaw in that product.
- Monitor web server logs for unusual HTTP requests to the tools.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert / CPU October 2026 www.oracle.com
- OpenCVE: CVE-2026-91270 app.opencve.io
- Vulners: CVE-2026-91270 vulners.com
- Strix: CVE-2026-91270 www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:33.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.