Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Oracle JD Edwards EnterpriseOne Tools is vulnerable due to improper access control and missing authentication for critical functions (CWE-306). A low‑privileged attacker with network access via HTTP can exploit these weaknesses to gain unauthorized control. Successful exploitation can lead to full takeover of the Tools component, compromising confidentiality, integrity, and availability across the JD Edwards environment.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected, specifically the Enterprise Infrastructure SEC component.

Risk and Exploitability

The CVSS base score of 8.8 classifies this vulnerability as high severity. The attack vector is network, with a required low privilege level and no user interaction. The EPSS score is very low (<1%), indicating a low likelihood of exploitation, but the high CVSS score and easy HTTP access keep the overall risk significant. It is not listed in CISA KEV.

Generated by OpenCVE AI on October 29, 2026 at 00:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch that addresses the JD Edwards EnterpriseOne Tools vulnerability.
  • Limit HTTP access to the JD Edwards Tools interface by blocking it from public networks and allowing only trusted IP ranges.
  • Continuously monitor application and network logs for anomalous authentication attempts or abnormal traffic patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on October 29, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Attack Enables Full Takeover of JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools HTTP Vulnerability Enables Remote Code Execution
Weaknesses CWE-284

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools HTTP Vulnerability Enables Remote Code Execution
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T19:39:27.822Z

Reserved: 2026-09-14T22:10:16.623Z

Link: CVE-2026-91295

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:31.093

Modified: 2026-11-02T18:50:44.663

Link: CVE-2026-91295

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T01:00:19Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function