Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

A flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools allows a low‑privileged user with network access over HTTP to obtain unsanctioned read and write permissions on the system’s data. The vulnerability results in confidentiality and integrity compromises, with the potential for unauthorized updates, insertions, deletions, and data disclosure. It does not provide remote code execution; rather, it concerns improper access control (CWE‑284).

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. The flaw resides in the Web Runtime SEC component and may impact other JD Edwards products due to a scope change.

Risk and Exploitability

The CVSS v3.1 base score of 5.4 indicates moderate severity. The EPSS score is below 1%, denoting a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to deliver a crafted HTTP request, and the flaw requires user interaction from a second person, which limits widespread automated exploitation. However, the possibility of manually targeted attacks and the sensitive data involved still represent a credible threat that warrants prompt action.

Generated by OpenCVE AI on October 29, 2026 at 00:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch for JD Edwards EnterpriseOne Tools that addresses the Web Runtime SEC vulnerability.
  • Block or tightly control direct HTTP traffic to the Tools by using firewall rules, VPN, or network segmentation, ensuring only trusted internal networks and administrators can reach the interface.
  • Restrict permissions for low‑privilege accounts, granting read‑only access wherever possible and preventing write operations unless required for legitimate business processes.
  • Enable detailed logging for data modification and read requests, and regularly review logs for anomalous activity.

Generated by OpenCVE AI on October 29, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromises JD Edwards EnterpriseOne Tools Data Access
Weaknesses CWE-285

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromises JD Edwards EnterpriseOne Tools Data Access
Weaknesses CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T19:42:17.719Z

Reserved: 2026-09-14T22:10:16.624Z

Link: CVE-2026-91298

cve-icon Vulnrichment

Updated: 2026-10-28T19:42:07.514Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:31.437

Modified: 2026-11-02T18:48:01.140

Link: CVE-2026-91298

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T00:30:14Z

Weaknesses