Oracle JD Edwards EnterpriseOne Tools: Privilege escalation in Installation Security
Summary
A flaw in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools allows a low-privileged user who can log on to the server running the software to take over the EnterpriseOne Tools installation. Successful exploitation affects confidentiality, integrity and availability (CVSS 3.1 7.8). The attack requires local logon to the infrastructure and is not reachable without authentication.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.5
Fixed in
- Unknown. Install the JD Edwards EnterpriseOne Tools security patch from the October 2026 Critical Patch Update. Confirm the patched build in the Oracle advisory (JD Edwards section) or My Oracle Support.
Workaround
- Unknown. No workaround is documented in the sources. Until patched, restrict interactive logon to the servers hosting EnterpriseOne Tools to required administrators.
Exploitation
- No exploitation known. Oracle reports no exploitation for the October 2026 CPU CVEs, and no public proof of concept was found. CISA SSVC lists exploitation as none and automatable as no.
Our recommendation
- Check whether EnterpriseOne Tools 9.2.0.0 to 9.2.26.5 is in use.
- Apply the October 2026 CPU patch for JD Edwards EnterpriseOne Tools as part of the normal patch cycle.
- Limit server logon on JD Edwards hosts to administrators and remove unused accounts with logon rights.
- Review sibling CVEs in the same CPU, especially CVE-2026-91299 (CVSS 10.0, Orchestrator), and patch those first if affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- OpenCVE: CVE-2026-91306 app.opencve.io
- Vulners: CVE-2026-91306 vulners.com
- Strix: CVE-2026-91306 www.strix.ai
- Brandefense: Oracle October 2026 CPU summary brandefense.io
- Tenable: Oracle October 2026 CPU summary www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:18.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.