Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

A flaw in the JD Edwards EnterpriseOne Tools installation security component permits an unauthenticated attacker who can reach the system over HTTP to compromise the tool and potentially gain full control. The vulnerability stems from missing authentication safeguards (CWE-306) and results in a loss of confidentiality, integrity, and availability.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.4 are affected. The product, provided by Oracle Corporation, is reachable via HTTP and includes an installation interface that can be accessed from the network.

Risk and Exploitability

The EPSS score of < 1% indicates a very low exploitation probability, yet the CVSS 3.1 base score of 8.1 signifies high severity. The vulnerability is difficult to exploit, but it allows unauthenticated attackers to compromise the tools without prior authentication. The attack vector is network-based, targeting the HTTP installation interface, and successful exploitation could lead to full takeover, allowing arbitrary code execution, data manipulation, or service disruption. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 28, 2026 at 23:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s security portal for an available patch or update for JD Edwards EnterpriseOne Tools and apply it immediately.
  • If a patch is not available, restrict HTTP access to the JD Edwards EnterpriseOne Tools deployment to trusted networks or VPNs, and block all other inbound traffic with firewall rules.
  • Consider segmenting the JD Edwards EnterpriseOne Tools environment from the rest of the network and enable robust logging to detect and respond to suspicious activity.

Generated by OpenCVE AI on October 28, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Installation Interface Vulnerability Enabling Tool Takeover

Wed, 28 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in JD Edwards EnterpriseOne Tools Installation
Weaknesses CWE-284
CWE-287

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Wed, 21 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via HTTP in JD Edwards EnterpriseOne Tools Installation
Weaknesses CWE-284
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T19:32:54.837Z

Reserved: 2026-09-14T22:10:16.626Z

Link: CVE-2026-91313

cve-icon Vulnrichment

Updated: 2026-10-28T19:32:49.971Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:33.147

Modified: 2026-11-02T18:42:06.807

Link: CVE-2026-91313

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:45:14Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function