Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools. It allows an attacker with low privileges and network access over HTTP to exploit an easily exploitable flaw that can lead to a full takeover of the application, compromising confidentiality, integrity, and availability of all managed data.

Affected Systems

Affected products are Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. These are the only versions identified as vulnerable in the Oracle September/October 2026 security advisory.

Risk and Exploitability

The CVSS v3.1 base score is 8.8, signifying high severity. The attack vector is network-based (HTTP), and the exploit requires low privileges but is considered easily exploitable. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, yet its high impact and network reach warrant immediate remediation.

Generated by OpenCVE AI on October 21, 2026 at 14:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the Oracle September/October 2026 critical patch update for JD Edwards EnterpriseOne Tools 9.2.26.5 or later, as detailed in the Oracle security advisory.
  • Restrict inbound HTTP/HTTPS traffic to the JD Edwards Web Runtime SEC component to trusted IP ranges using firewall rules or network segmentation until the patch is applied.
  • Enable detailed logging for the Web Runtime SEC component and monitor for anomalous access patterns or service disruptions, investigating any suspicious events promptly.

Generated by OpenCVE AI on October 21, 2026 at 14:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in JD Edwards EnterpriseOne Tools Web Runtime SEC
Weaknesses CWE-284
CWE-639

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:24:48.370Z

Reserved: 2026-09-14T22:10:16.619Z

Link: CVE-2026-91268

cve-icon Vulnrichment

Updated: 2026-10-28T20:24:41.359Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:27.893

Modified: 2026-11-02T15:08:14.140

Link: CVE-2026-91268

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key