Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Sensitive Data
Action: Immediate Patch
AI Analysis

Impact

The JD Edwards EnterpriseOne Tools installation security component contains a flaw that permits an attacker without authentication to access the application over the Oracle Net protocol. Exploiting this flaw provides unauthorized read access to any data the tool can view, potentially exposing sensitive business data. The weakness is caused by a missing authentication check and is identified as CWE‑200.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5 are impacted. These releases are available for installation in environments that have not applied the October 2026 Critical Patch Update from Oracle.

Risk and Exploitability

The vulnerability carries a CVSS 3.1 Base Score of 7.5, indicating high risk to confidentiality. The EPSS score is < 1 %, implying a very low but nonzero likelihood of exploitation in the wild. Attackers only need unauthenticated network access to the Oracle Net service; no credentials or additional privileges are required. The flaw is not listed in CISA’s KEV catalog, but because of the confidentiality impact it remains a high‑priority threat for organizations running the affected JD Edwards versions.

Generated by OpenCVE AI on October 29, 2026 at 00:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle's latest JD Edwards EnterpriseOne Tools patch released in the October 2026 CPU on all affected systems.
  • Restrict inbound Oracle Net traffic to the JD Edwards application by configuring firewalls or ACLs to only allow trusted IP addresses.
  • Enable detailed auditing and monitoring of Oracle Net connections to detect unauthorized or suspicious activity, and review logs for signs of exploitation attempts.

Generated by OpenCVE AI on October 29, 2026 at 00:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Unauthenticated Oracle Net Access Vulnerability

Wed, 28 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access to JD Edwards EnterpriseOne Tools via Oracle Net
Weaknesses CWE-287

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access to JD Edwards EnterpriseOne Tools via Oracle Net
Weaknesses CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T19:29:01.183Z

Reserved: 2026-09-14T22:10:16.625Z

Link: CVE-2026-91308

cve-icon Vulnrichment

Updated: 2026-10-28T19:28:52.367Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:32.580

Modified: 2026-11-02T18:44:41.723

Link: CVE-2026-91308

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T01:00:19Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor