Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated data modification and exposure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in JD Edwards EnterpriseOne Tools enables an unauthenticated attacker with network access via HTTP to modify, delete, insert, or read data that should only be accessible to authorized users. A successful attack alters information integrity and reveals sensitive data, thereby exposing the organization to potential financial loss, regulatory non-compliance, or operational disruption. The flaw does not allow arbitrary code execution but grants significant data manipulation authority, representing a moderate to high risk to confidentiality and integrity.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5. Only Oracle was identified as impacted, though the underlying flaw may affect adjacent components if that code paths exists.

Risk and Exploitability

The CVSS 3.1 base score of 6.1 indicates moderate severity, with minimal confidentiality and integrity impacts. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is network‑based via HTTP, requiring no privileged access but does need a human to send the request. Because the flaw resides in JD Edwards EnterpriseOne Tools, there is potential for a broader scope change that could affect additional products.

Generated by OpenCVE AI on October 21, 2026 at 09:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch from the CPU Oct 2026 advisory.
  • Restrict HTTP access to the Web Runtime SEC interface to trusted internal networks only.
  • Enforce additional access controls or temporarily disable the affected functionality until the patch is applied.

Generated by OpenCVE AI on October 21, 2026 at 09:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Modification in JD Edwards EnterpriseOne Tools
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:13:57.803Z

Reserved: 2026-09-14T22:10:16.621Z

Link: CVE-2026-91279

cve-icon Vulnrichment

Updated: 2026-10-28T20:13:51.622Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:29.280

Modified: 2026-11-02T18:07:51.580

Link: CVE-2026-91279

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:00:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control