Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools allows a low‑privileged attacker with network access over HTTP to create, delete, or modify critical data and gain unauthorized access to the system’s data. Successful exploitation results in the compromise of confidentiality and integrity of JD Edwards data, potentially affecting all users with access to the application.

Affected Systems

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5.

Risk and Exploitability

The flaw is assigned a CVSS v3.1 base score of 8.1, indicating a high severity level. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers may exploit the flaw over the network via HTTP, requiring only low privileged access. No additional software prerequisites or complex conditions are reported, making it relatively easy to launch an attack once network reach to the JD Edwards application is established.

Generated by OpenCVE AI on October 21, 2026 at 14:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch released in the Oct‑2026 CPU advisory.
  • Configure firewall rules to restrict HTTP access to the JD Edwards EnterpriseOne Tools to trusted network segments only.
  • Enforce least‑privilege access controls and monitor user activity for anomalous creation, deletion, or modification attempts.

Generated by OpenCVE AI on October 21, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Low‑Privilege HTTP Attacks in Oracle JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:26:12.423Z

Reserved: 2026-09-14T22:10:16.619Z

Link: CVE-2026-91269

cve-icon Vulnrichment

Updated: 2026-10-28T20:26:06.991Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:28.007

Modified: 2026-11-02T15:08:36.283

Link: CVE-2026-91269

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses