Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and read via unauthenticated HTTP access
Action: Apply Patch
AI Analysis

Impact

The vulnerability in JD Edwards EnterpriseOne Tools' Web Runtime SEC component permits an unauthenticated attacker to send HTTP requests that can cause unauthorized updates, inserts, or deletes of data. The flaw is an improper access control issue, allowing a third party to alter or read protected information. A network attacker could leverage this flaw to compromise the confidentiality and integrity of the system’s data.

Affected Systems

Affected versions of JD Edwards EnterpriseOne Tools include 9.2.0.0 through 9.2.26.5. The flaw is present in the JD Edwards EnterpriseOne Tools product and may affect other JD Edwards applications that rely on the same runtime component. Oracle Corporation's JD Edwards EnterpriseOne Tools is the directly impacted product.

Risk and Exploitability

The CVSS v3.1 Base Score of 6.1 reflects moderate confidentiality and integrity impacts; the attack vector is network over HTTP with low complexity and no privileges required. Exploration demands a human action performed by a person other than the attacker, which reduces the likelihood of successful attacks. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited current exploitation.

Generated by OpenCVE AI on October 28, 2026 at 23:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade JD Edwards EnterpriseOne Tools to a version newer than 9.2.26.5 or apply the vendor’s patch addressing CVE-2026-91280.
  • Restrict or block unauthenticated HTTP access to the Web Runtime SEC component so that only authenticated users or internal networks can reach it.
  • Segregate JD Edwards servers from external networks with firewall rules or VPN and monitor traffic for suspicious HTTP requests targeting the affected component.
  • If a patch cannot be applied immediately, disable or limit the affected Web Runtime SEC feature until an update is available.

Generated by OpenCVE AI on October 28, 2026 at 23:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification and Read in JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:14:38.603Z

Reserved: 2026-09-14T22:10:16.621Z

Link: CVE-2026-91280

cve-icon Vulnrichment

Updated: 2026-10-28T20:14:31.304Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:29.393

Modified: 2026-11-02T18:07:20.957

Link: CVE-2026-91280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:15:14Z

Weaknesses