Oracle JD Edwards EnterpriseOne Tools: Privilege escalation via Installation Security
Summary
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.4 contain a vulnerability in the Installation Security component. An unauthenticated attacker with access to the physical network segment of the hardware running JD Edwards EnterpriseOne Tools can compromise the product, which can lead to a full takeover, provided a user interacts with the attack. Because the scope is changed, other products may also be impacted.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4
- Possibly 9.2.26.5 (unconfirmed, sibling CVE data lists a higher bound)
Fixed in
- Unknown. Check the Oracle October 2026 Critical Patch Update advisory.
Workaround
- No workaround is given in the CVE record.
- Until a patch is applied, restrict Layer 2 access with VLAN segmentation and port security.
- Limit physical access to server rooms and network ports.
- Allow only authorised administrators to run installation or maintenance tasks.
- Keep JDE Tools hosts off the internet and out of the DMZ.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No known exploitation in the wild in the sources reviewed.
- No public proof of concept found; this is not proof of absence.
Our recommendation
- Check whether JDE EnterpriseOne Tools hosts are reachable from untrusted networks, guest Wi-Fi or shared LAN segments.
- Obtain the fixed build from Oracle's October 2026 CPU advisory and apply it in the next maintenance window.
- Apply the mitigations above until the patch is installed.
- Monitor the Installation Security component and the affected hosts for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- OpenCVE CVE-2026-91326 app.opencve.io
- Vulners CVE-2026-91326 vulners.com
- Strix CVE-2026-91326 www.strix.ai
- Vulners CVE-2026-91314 (sibling, version range) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:30.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.