JD Edwards EnterpriseOne Tools: Local takeover in Deployment component
Summary
A flaw in the Deployment component (SEC) of JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 allows an attacker to take over the Tools application. The attacker needs local logon to the infrastructure where Tools runs, and a person other than the attacker must interact with the system. Successful exploitation affects confidentiality, integrity and availability. The CVE record lists the CWE as CWE-601, which does not clearly match this description.
Affected
- JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5
- Component: Deployment SEC
Fixed in
- Apply the JD Edwards EnterpriseOne Tools patch from Oracle's October 2026 Critical Patch Update (CPU).
- Specific fixed patch level: Unknown. Check Oracle's advisory for your release.
Workaround
- Unknown. The CVE record provides no workaround.
- Restrict logon access to servers hosting Tools (interim measure, not vendor guidance).
Exploitation
- Not listed in CISA KEV.
- EPSS score below 1%.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept or in-the-wild exploitation known as of the research date.
Our recommendation
- Patch JD Edwards EnterpriseOne Tools in the regular October 2026 CPU cycle.
- Patch CVE-2026-91299 (Orchestrator, CVSS 10.0) first if Orchestrator is enabled and reachable from outside.
- Restrict logon access to servers hosting Tools and monitor those hosts for suspicious logons until patched.
- Verify the CWE classification on NVD before relying on it.
- Raise the priority if the servers have wide internal access or weak logon controls.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert – October 2026 CPU www.oracle.com
- OpenCVE – CVE-2026-91328 app.opencve.io
- Vulners – CVE-2026-91328 vulners.com
- Strix – CVE-2026-91328 www.strix.ai
- Brandefense – Oracle October 2026 Critical Patch Update brandefense.io
- Waratek – Oracle October 2026 Critical Patch Update waratek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:16.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.