Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote System Compromise
Action: Immediate Patch
AI Analysis

Impact

Oracle’s JD Edwards EnterpriseOne Tools contain a flaw in the Monitoring and Diagnostics SEC component that can be triggered via HTTP requests. An attacker with low privileges and network access can exploit this vulnerability to take full control of the tools, leading to complete compromise. The flaw results in simultaneous loss of confidentiality, integrity, and availability, as indicated by the high CVSS score.

Affected Systems

The affected product is Oracle JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5. This includes the Monitoring and Diagnostics SEC component.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 classifies it as high severity, and the EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The lack of a KEV listing does not diminish the potential impact. The vulnerability can be exploited over the network via HTTP by a low‑privileged attacker without user interaction. Such an attack path allows immediate takeover of the JD Edwards EnterpriseOne Tools environment.

Generated by OpenCVE AI on October 29, 2026 at 00:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch released in the October 2026 Oracle Security Alert for CVE-2026-91270 to all affected JD Edwards EnterpriseOne Tools installations.
  • Restrict HTTP access to the Monitoring and Diagnostics endpoint using firewall rules or VPNs so that only trusted network segments can reach the vulnerable component.
  • If the Monitoring and Diagnostics service is not required, disable or uninstall it to eliminate the attack surface.

Generated by OpenCVE AI on October 29, 2026 at 00:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Remote System Compromise via Unauthenticated HTTP Endpoint in JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Remote System Compromise via Monitoring and Diagnostics Endpoint
Weaknesses CWE-284

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Remote System Compromise via Monitoring and Diagnostics Endpoint
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:27:15.013Z

Reserved: 2026-09-14T22:10:16.620Z

Link: CVE-2026-91270

cve-icon Vulnrichment

Updated: 2026-10-28T20:27:07.761Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:28.137

Modified: 2026-11-02T15:08:52.550

Link: CVE-2026-91270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T00:30:14Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function