IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle JD Edwards EnterpriseOne Tools: Compromise via adjacent network access

CVE-2026-91286High 8.2

← All vulnerabilities

Summary

A flaw in the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with access to the network segment of the affected host to compromise the product. Successful exploitation can lead to unauthorized read access to critical data and limited unauthorized modification of data, and the scope change means impact may reach beyond the Tools component. The CVSS base score is 8.2; the attack requires no authentication or user interaction but adjacent-network access.

Affected

  • Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (inclusive)
  • Component: Monitoring and Diagnostics SEC

Fixed in

Unknown. Check the Oracle Critical Patch Update October 2026 for patch details.

Workaround

Unknown. The CVE record gives no vendor workaround.

  • Generic mitigation (not vendor-verified): limit devices sharing the network segment with JD Edwards Tools hosts and separate that segment from office, guest and IoT networks.

Exploitation

  • Attack vector: Adjacent network (AV:A); not internet-facing.
  • CISA SSVC: exploitation none, not automatable.
  • EPSS very low (below 1%).
  • No public proof of concept or known exploitation found in a limited search; not listed in CISA KEV according to a mirror, not verified directly.

Our recommendation

  • Check whether JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.5 is in use.
  • Apply the Oracle October 2026 Critical Patch Update once patch details are confirmed.
  • Restrict which devices share the segment with Tools hosts and isolate that segment.
  • Restrict administrative access to the hosts and monitor for unexpected access from the local segment.
  • Prioritise the other October 2026 JD Edwards Tools flaws reachable over HTTP if the web tier is internet-facing.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:26.

Original description (NVD)

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed