Description
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure of restricted data
Action: Apply Patch
AI Analysis

Impact

Vulnerability in JD Edwards EnterpriseOne Orchestrator permits an unauthenticated attacker with HTTP network access to read a subset of Orchestrator‑accessible data. This unauthorized data reading results in confidentiality loss but does not affect integrity or availability. The attacker requires only connectivity, not credentials or elevated privileges.

Affected Systems

The flaw exists in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5, specifically within the E1 IOT Orchestrator Security component. Any installation of these affected versions exposed to HTTP traffic is vulnerable. The product is Oracle’s JD Edwards EnterpriseOne Orchestrator.

Risk and Exploitability

The base score of 5.3 on CVSS 3.1 indicates a moderate confidentiality impact. No EPSS score is available, so the public exploit probability remains unquantified, and the vulnerability is not listed in CISA KEV, implying no known active exploitation. Nevertheless, the fault can be triggered with simple HTTP requests, making it readily exploitable once the Orchestrator is reachable over the network.

Generated by OpenCVE AI on October 21, 2026 at 09:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s latest JD Edwards EnterpriseOne Orchestrator patch covering versions 9.2.0.0 through 9.2.26.5
  • Restrict HTTP access to the Orchestrator by confining it to trusted networks or VPN tunnels and enforcing firewall rules
  • Enable authentication and enforce strict access controls on the Orchestrator API endpoints to block unauthenticated requests

Generated by OpenCVE AI on October 21, 2026 at 09:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Exposes Restricted Data in JD Edwards EnterpriseOne Orchestrator
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Orchestrator
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Orchestrator
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Orchestrator
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:11:52.356Z

Reserved: 2026-09-14T22:10:16.621Z

Link: CVE-2026-91277

cve-icon Vulnrichment

Updated: 2026-10-28T20:11:29.715Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:29.047

Modified: 2026-11-02T19:57:24.660

Link: CVE-2026-91277

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control