Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to JD Edwards EnterpriseOne Tools data
Action: Apply Patch
AI Analysis

Impact

JD Edwards EnterpriseOne Tools is vulnerable to an unauthenticated HTTP request that can provide attackers with access to all data exposed by the installation component. The flaw, located in the installation security layer, allows an attacker to read critical data without prior authentication. The weakness is classified under CWE-200, reflecting a lack of safeguards against information disclosure.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5. The vulnerability exists in the installation security component and impacts all releases within this range.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates a high risk, with probing via HTTP and no authentication or UI required. EPSS shows a probability of less than 1%, suggesting low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is an unauthenticated HTTP request to the install service; any host that can reach this endpoint can exploit the flaw to access sensitive data.

Generated by OpenCVE AI on October 28, 2026 at 23:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle's latest patch to JD Edwards EnterpriseOne Tools; any patch that removes the installation-time security flaw or updates the product beyond version 9.2.26.5 should be installed immediately.
  • Restrict network access to the JD Edwards installation service by configuring firewalls or IP whitelisting so that only trusted internal hosts can reach the HTTP endpoints that expose the vulnerable component.
  • Review and harden the installation configuration according to Oracle's security guidance, ensuring that all access to JD Edwards services requires proper authentication and authorization.

Generated by OpenCVE AI on October 28, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Allows Unauthorized Data Access in JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Wed, 28 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Allows Unauthorized Data Access in JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T18:12:51.406Z

Reserved: 2026-09-14T22:10:16.627Z

Link: CVE-2026-91325

cve-icon Vulnrichment

Updated: 2026-10-28T18:12:46.661Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:34.570

Modified: 2026-10-28T19:19:20.530

Link: CVE-2026-91325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T23:45:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor