Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service due to local low‑privileged exploitation in JD Edwards EnterpriseOne Tools
Action: Assess Impact
AI Analysis

Impact

A flaw in the Installation Security component of JD Edwards EnterpriseOne Tools allows a user with a low‑privileged local account on the infrastructure where the tools run to trigger a partial denial of service. The vulnerability can be exploited with minimal effort and no user interaction, and it impacts only availability while leaving confidentiality and integrity untouched.

Affected Systems

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected.

Risk and Exploitability

The CVSS vector shows a low impact availability flaw (CVSS 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). The EPSS score is reported as <1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, which means no known public exploits exist. Nevertheless, an attacker who can log on with low privileges can easily induce a service interruption in the affected versions.

Generated by OpenCVE AI on October 28, 2026 at 22:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch or update disclosed in Oracle’s CPU Oct 2026 advisory for JD Edwards EnterpriseOne Tools versions 9.2.0.0–9.2.26.5.
  • Enforce least privilege on the host by limiting local accounts that can start or run JD Edwards EnterpriseOne Tools.
  • Ensure proper shutdown and resource cleanup of the tools, following Oracle’s guidelines, to resolve the CWE‑404 improper resource release vulnerability.
  • Monitor application logs and service availability for indications of repetitive crashes or error spikes that could signal an attempted denial of service.

Generated by OpenCVE AI on October 28, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Local Denial of Service in JD Edwards EnterpriseOne Tools via Installation Security
Weaknesses CWE-250

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-404

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Local Denial of Service in JD Edwards EnterpriseOne Tools via Installation Security
Weaknesses CWE-250

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T17:31:33.210Z

Reserved: 2026-09-14T22:10:16.628Z

Link: CVE-2026-91330

cve-icon Vulnrichment

Updated: 2026-10-28T17:31:29.385Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:35.157

Modified: 2026-10-28T18:17:21.567

Link: CVE-2026-91330

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T22:45:15Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release