Oracle JD Edwards EnterpriseOne Tools: Missing authentication enables takeover
Summary
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected by a vulnerability in the Enterprise Infrastructure SEC component. An attacker with network access via HTTP and a low-privilege account can compromise the product, with high impact on confidentiality, integrity and availability (CVSS 8.8). No user interaction is required. The NVD record lists CWE-306 (missing authentication), and the exact preconditions still need confirmation from Oracle's advisory.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (component: Enterprise Infrastructure SEC)
Fixed in
- Unknown. Expected in Oracle's October 2026 Critical Patch Update (20 October 2026); the specific patch or release has not been confirmed.
Workaround
- Unknown. No workaround is documented in the CVE record.
Exploitation
- Not listed in CISA KEV.
- EPSS below 1% (very low).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept or in-the-wild exploitation found in the sources consulted; this does not prove none exists.
Our recommendation
- Confirm the affected Tools release and the patch in Oracle's October 2026 CPU advisory and apply it as soon as possible.
- Check whether any HTTP path to EnterpriseOne is reachable from the internet and restrict access if so.
- Review low-privilege accounts and monitor the HTTP tier for unusual activity until patched.
- Re-check CISA KEV and NVD, as the NVD analysis was still in progress.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- Vulners CVE-2026-91295 vulners.com
- OpenCVE CVE-2026-91295 app.opencve.io
- Strix CVE-2026-91295 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:32.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.