Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification with possible denial of service
Action: Apply patch
AI Analysis

Impact

Vulnerability exists in the installation security component of Oracle JD Edwards EnterpriseOne Tools. An attacker who already has physical or network access to the infrastructure and is able to run the tools can exploit this flaw to create, delete, or modify critical data, read confidential information, and trigger hangs or crashes that deny service. The flaw is rated CVSS 3.1 score 6.5, indicating moderate confidentiality, integrity, and availability impact.

Affected Systems

Affected versions are Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, all installed on any server environment where JD Edwards EnterpriseOne Tools executes.

Risk and Exploitability

The exploit requires a local attacker who has logged on to the infrastructure and can interact with a user who is not the attacker; the attack vector is local. The EPSS score of 0.00124 indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. With the CVSS score of 6.5, the risk remains moderate, and the impact could be significant in environments where JD Edwards holds critical business data.

Generated by OpenCVE AI on October 21, 2026 at 15:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent security update for JD Edwards EnterpriseOne Tools that addresses this vulnerability (check Oracle’s security updates for the latest available version or patch level).
  • Restrict local access to the servers that run JD Edwards EnterpriseOne Tools and enforce least privilege and role‑based controls for users.
  • Deploy monitoring and alerting to detect unauthorized data modification or repeated outages caused by hangs or crashes.
  • Provide user training to reduce the success of social‑engineering attempts that could be used to trigger the vulnerability.

Generated by OpenCVE AI on October 21, 2026 at 15:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Local Vulnerability in JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T17:32:21.435Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91329

cve-icon Vulnrichment

Updated: 2026-10-28T17:32:13.422Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:35.033

Modified: 2026-10-28T18:17:21.360

Link: CVE-2026-91329

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:30:09Z

Weaknesses