Oracle JD Edwards EnterpriseOne Tools: Improper access control
Summary
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 contain a vulnerability in the Enterprise Infrastructure SEC component. An unauthenticated attacker on the physical network segment shared with the host can, without user interaction, create, delete or modify critical data and access data accessible through the Tools. The attack requires access to the local network segment, not the internet.
Affected
- JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.5 (supported versions, per CVE record)
Fixed in
Unknown. Obtain the October 2026 Critical Patch Update patch list for JD Edwards from My Oracle Support (MOS) and apply the fix for this CVE.
Workaround
- Unknown. The CVE record provides no workaround.
- Restrict which systems and users share the network segment with the Tools servers, using VLAN or firewall rules.
Exploitation
- Not listed in the CISA KEV catalogue (according to OpenCVE).
- EPSS about 0.24%.
- No public proof-of-concept or in-the-wild exploitation found. This is a lack of findings, not confirmation that none exists.
Our recommendation
- Confirm whether JD Edwards EnterpriseOne Tools 9.2.x is in use and which exact version is installed.
- If it is, apply the October 2026 CPU fix covering this CVE and CVE-2025-15467 (OpenSSL, rated 9.8 in Tools).
- Until patched, ensure the Tools servers are not reachable from guest Wi-Fi, IoT or other untrusted segments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- NVD record via Vulners CVE-2026-91287 vulners.com
- OpenCVE CVE-2026-91287 app.opencve.io
- Strix CVE-2026-91287 www.strix.ai
- Oracle JD Edwards blog on August 2026 CPU (MOS patch lists) blogs.oracle.com
- HivePro October 2026 CPU threat advisory www.hivepro.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:15.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.