Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-10-20
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to confidential data
Action: Immediate Patch
AI Analysis

Impact

An exploitable flaw in JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with network access to an HTTP interface to bypass built‑in access controls. The vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. The CVSS v3.1 Base Score of 8.6 reflects large confidentiality impact while integrity and availability remain unaffected.

Affected Systems

Oracle Corporation JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected. The scope change indicated in the advisory means that other JD Edwards products that interact with or rely on JD Edwards EnterpriseOne Tools could also be impacted.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, yet the CVSS score demonstrates high severity. Attackers can exploit it remotely over HTTP without authentication, making it easily reachable from outside the organization. The scope change amplifies the potential damage across multiple products, raising the overall risk level.

Generated by OpenCVE AI on October 21, 2026 at 16:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Follow Oracle’s security bulletin and upgrade JD Edwards EnterpriseOne Tools to a version that contains the fix for CVE‑2026‑91273.
  • Restrict network access to the JD Edwards EnterpriseOne Tools HTTP interface by configuring firewalls or VPNs so that only trusted hosts can reach the service.
  • Enable comprehensive application and network logging, and set up alerts for unusual authentication bypass attempts or data access patterns.
  • Review and enforce role‑based access controls to ensure that only authorized users can view or modify sensitive JD Edwards EnterpriseOne data.

Generated by OpenCVE AI on October 21, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Compromises Confidential Data in JD Edwards EnterpriseOne Tools
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:06:34.991Z

Reserved: 2026-09-14T22:10:16.620Z

Link: CVE-2026-91273

cve-icon Vulnrichment

Updated: 2026-10-28T20:06:28.004Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:28.517

Modified: 2026-11-02T15:10:39.167

Link: CVE-2026-91273

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control