Oracle JD Edwards EnterpriseOne Tools: Missing authentication, full takeover
Summary
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains a flaw in the Installation SEC component that is reachable via the JDENET interface. An attacker with a valid low-privileged account and network access to JDENET can take over the Tools installation without user interaction. This is not an unauthenticated internet exploit, but a compromised employee, partner account or attacker inside the network could exploit it. The CNA rates the impact as total, and the CVSS base score is 8.8 (NVD and CNA); VulDB rates it 6.3 and lists CWE-269 instead of CWE-306.
Affected
- JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5
Fixed in
- Unknown. Obtain the exact patch from the October 2026 Critical Patch Update via My Oracle Support.
Workaround
- No workaround is documented in the CVE record.
- Restrict JDENET reachability to required internal hosts only.
- Review which accounts hold low-privileged access.
Exploitation
- No evidence of in-the-wild exploitation found; not listed in KEV (snapshot may be outdated).
- No public proof-of-concept found for this CVE.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Confirm whether your EnterpriseOne Tools release is between 9.2.0.0 and 9.2.26.5.
- Obtain the exact fix from the October 2026 CPU via My Oracle Support and apply it in the next maintenance window.
- Limit JDENET to internal network segments and audit low-privileged accounts.
- Patch the whole JD Edwards stack in the same cycle; CVE-2026-91299 (Orchestrator, CVSS 10.0) is a higher priority if exposed.
- Re-check KEV and vendor advisories until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory - October 2026 www.oracle.com
- Oracle Security Alerts www.oracle.com
- VulDB entry VDB-423975 vuldb.com
- OpenCVE CVE-2026-91310 app.opencve.io
- Strix CVE-2026-91310 www.strix.ai
- Brandefense Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:31.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.