Oracle JD Edwards EnterpriseOne Tools: Privilege escalation in Installation Security
Summary
JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 are affected by a flaw in the Installation Security component. An attacker with local logon to the infrastructure where the product runs can compromise the product, which Oracle rates as a total takeover, if a user interacts with the attack. Exploitation requires user interaction by a person other than the attacker. No exploitation in the wild or public proof of concept is known at the time of writing.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.5 (per CNA record)
- Fixed release numbers: Unknown. Confirm in Oracle's advisory.
Fixed in
- Unknown. Oracle's October 2026 Critical Patch Update is the referenced fix; confirm the patched release in the advisory.
Workaround
- None documented in the CVE record.
- Interim measure: limit local logon to hosts running JD Edwards EnterpriseOne Tools and restrict administrative access until patched.
Exploitation
- Exploited in the wild: Unknown, not listed in CISA KEV.
- Public proof of concept: none found.
- Attack requires local access, low complexity, no privileges and user interaction.
Our recommendation
- Check whether JD Edwards EnterpriseOne Tools is installed and which hosts run it.
- Apply Oracle's October 2026 Critical Patch Update, and patch the whole JD Edwards family in the same window.
- Restrict local logon and administrative access to JD Edwards hosts until patched.
- Monitor for unusual logons and changes on these hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- OpenCVE CVE-2026-91304 app.opencve.io
- VulnDB 423984 vuldb.com
- Vulners CVE-2026-91304 vulners.com
- Strix CVE-2026-91304 www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:17.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.