Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and integrity compromise
Action: Patch Immediately
AI Analysis

Impact

A flaw in the Monitoring and Diagnostics component of Oracle JD Edwards EnterpriseOne Tools lets an unauthenticated attacker who can reach the server over HTTP read, update, insert, or delete critical data. The vulnerability can expose confidential information and tamper with data integrity, impacting both confidentiality (high) and integrity (low).

Affected Systems

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5 inclusive, are affected. These installations expose the vulnerable Monitoring and Diagnostics functionality to anyone with network access to the HTTP endpoint.

Risk and Exploitability

The CVSS base score of 6.5 places the vulnerability at medium severity. The EPSS score is present and below 1 %, indicating a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Because authentication is not required and the attack surface is the public HTTP interface, the risk is real, especially for systems exposed to untrusted networks.

Generated by OpenCVE AI on October 29, 2026 at 01:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or update provided in Oracle's CPU October 2026 advisory for JD Edwards EnterpriseOne Tools
  • Configure firewalls or VPNs to restrict external HTTP access to the JD Edwards instance
  • Ensure that all Monitoring and Diagnostics functions are protected by authentication and that users have only the least‑privilege permissions required

Generated by OpenCVE AI on October 29, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access via JD Edwards EnterpriseOne Monitoring and Diagnostics

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Unauthenticated HTTP in JD Edwards EnterpriseOne Tools
Weaknesses CWE-200
CWE-284

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Unauthenticated HTTP in JD Edwards EnterpriseOne Tools
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:07:44.079Z

Reserved: 2026-09-14T22:10:16.620Z

Link: CVE-2026-91274

cve-icon Vulnrichment

Updated: 2026-10-28T20:07:32.059Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:28.660

Modified: 2026-11-02T15:06:35.187

Link: CVE-2026-91274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T02:00:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function