Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote unauthorized data modification
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Monitoring and Diagnostics SEC component of Oracle JD Edwards EnterpriseOne Tools permits an attacker with low privileges and network access via HTTP to create, delete, or modify critical data, and to gain unauthorized read access to all accessible data, resulting in confidentiality and integrity compromise.

Affected Systems

The affected product is Oracle JD Edwards EnterpriseOne Tools Monitoring and Diagnostics SEC, versions 9.2.0.0 through 9.2.26.5.

Risk and Exploitability

The CVSS 3.1 base score of 8.1 indicates significant impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be network‑based via HTTP, and the vulnerability is described as easily exploitable by a low‑privileged attacker.

Generated by OpenCVE AI on October 21, 2026 at 14:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s latest patch or upgrade JD Edwards EnterpriseOne Tools to a version newer than 9.2.26.5.
  • Restrict HTTP access to the JD Edwards EnterpriseOne Tools servers by placing them behind a secure perimeter and using firewall rules.
  • Enforce strict role‑based access controls to ensure that only authorized users can create, delete, or modify critical data.

Generated by OpenCVE AI on October 21, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Remote Low‑Privilege Access Exploit
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:28:22.615Z

Reserved: 2026-09-14T22:10:16.620Z

Link: CVE-2026-91271

cve-icon Vulnrichment

Updated: 2026-10-28T20:28:17.114Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:28.273

Modified: 2026-11-02T15:09:54.797

Link: CVE-2026-91271

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses