Oracle JD Edwards EnterpriseOne Tools: Missing authentication in Installation Security
Summary
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.4 contains a flaw in the Installation Security component that allows unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation could lead to full takeover of the affected EnterpriseOne Tools installation, with high impact on confidentiality, integrity and availability. The attack complexity is high, and no public exploit or in-the-wild exploitation has been reported.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 (per CVE record)
- Sibling CVEs from the same CPU list 9.2.26.5 as affected; this conflict is unresolved.
Fixed in
- Fix provided in Oracle's October 2026 Critical Patch Update (published 20 October 2026).
- Fixed version number: Unknown. Check Oracle's advisory table or Oracle Support (CPU289).
Workaround
- Unknown. The CVE record provides no workaround.
- Restrict HTTP access to EnterpriseOne Tools to internal management networks and VPN only, pending vendor confirmation.
Exploitation
- CISA KEV: not listed.
- No public proof-of-concept found.
- Oracle has not flagged October 2026 CPU vulnerabilities as exploited in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether JD Edwards EnterpriseOne Tools is in use at all.
- If it is reachable from outside the network, treat as high priority; if internal only, treat as medium.
- Apply Oracle's October 2026 CPU fix after confirming the fixed version in Oracle's advisory.
- Restrict HTTP access to trusted networks and confirm no installation or setup endpoints are exposed to the internet.
- Monitor logs for unexpected requests to installation components.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- Oracle Security Blog: October 2026 CPU released blogs.oracle.com
- OpenCVE CVE-2026-91313 app.opencve.io
- VulDB CVE-2026-91313 vuldb.com
- Vulners/CIRCL CVE-2026-91313 vulners.com
- SecurityWeek: Oracle October 2026 CPU www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:14.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.