Oracle JD Edwards EnterpriseOne Tools: Improper access control in Installation Security
Summary
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 contain an improper access control flaw in the Installation Security component. An attacker with logon access to the infrastructure where the Tools run can compromise the application, but a second person must interact with the attack. A successful attack can lead to takeover of the Tools (CVSS 3.1: 7.8, High). The NVD record is still under analysis.
Affected
- JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5
Fixed in
Unknown. Apply Oracle's October 2026 Critical Patch Update (CPU) and verify the fixed build in the JD Edwards section of the Oracle advisory.
Workaround
- None documented for this CVE.
- Interim measures (not vendor-specified): restrict logon to JD Edwards servers to named administrators, limit who can log on to hosts running the Tools, and review administration and installation activity. These do not replace the patch.
Exploitation
- No known exploitation; not in the CISA KEV catalog as of 21 October 2026.
- EPSS below 1% (very low).
- No public proof of concept found. This means 'not found', not 'confirmed none'.
Our recommendation
- Patch JD Edwards EnterpriseOne Tools with Oracle's October 2026 CPU and verify the fixed build.
- Restrict logon to JD Edwards servers to named administrators and review their accounts.
- Check segmentation of the server network and monitor administration and installation activity.
- Also prioritise the same CPU's remote, unauthenticated JD Edwards flaws, for example CVE-2026-91299.
- Priority: medium for organisations running JD Edwards; more urgent if the servers are reachable from many internal segments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle CPU Advisory, October 2026 (primary) www.oracle.com
- NVD / Vulners record vulners.com
- OpenCVE app.opencve.io
- Strix www.strix.ai
- Tenable CPU analysis www.tenable.com
- Brandefense CPU analysis brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:17.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.