{"id":"CVE-2026-91265","kind":"vulnerability","aliases":["CVE-2026-91265"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Enterprise Infrastructure SEC component. An unauthenticated attacker over HTTP can read, modify, or delete data the application can access.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":["9.2.26.6"],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-erp","erp","jd-edwards","oracle","other","self-hosted","vendor"],"not_affected_if":["default-config","not-internet-exposed"],"how_to_check":"Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the Tools release shown at sign-on/About). Exposed if it is 9.2.0.0 through 9.2.26.5 and the JDE HTTP endpoints (web server/AIS) are reachable by an attacker.","fix":"Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support; Armis reports fixed in Tools 9.2.26.6 or later (not confirmed on Oracle's page). Workaround, per Armis only: restrict JDE HTTP endpoints at firewall/load balancer to trusted IP ranges; this does not remove the flaw for allowed networks.","status":"open","published_at":"2026-10-20T22:20:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:13+00:00","updated_at":"2026-10-23T22:58:39+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:34:13Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers 9.2.26.5 and earlier; check the Oracle advisory for the exact patch.","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical data","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Enterprise Infrastructure SEC component. An unauthenticated attacker over HTTP can read, modify, or delete data the application can access.","category":"vendor","who_cares":["jd-edwards","oracle","enterprise-erp","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads, changes or deletes all application data without logging in","analyst_note":"Find the Oracle CPU advisory for CVE-2026-91265 to confirm the fixed patch level and any workaround; the NVD text does not give a check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3172,"output_tokens":449,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory for CVE-2026-91265 to confirm the fixed patch level and any workaround; the NVD text does not give a check command.","search":"'-2026':13A,16A '-91265':14A,17A '/av':166C '3.1':154C,165C '9.1':157C '9.2.0.0':41B,90C '9.2.26.5':43B,91C 'access':67B,100C,122C,132C,138C,144C,151C 'affect':88C 'allow':95C 'applic':65B 'attack':55B,97C,110C 'base':155C 'complet':143C 'compon':52B,80C 'compromis':104C 'confidenti':158C 'contain':44B 'creation':118C 'critic':10A,124C,140C 'cve':12A,15A 'cvss':153C,162C,164C 'data':11A,63B,125C,133C,141C,152C 'delet':62B,119C 'easili':92C 'edward':3A,28B,37B,72C,79C,106C,129C,148C 'edwards':19A 'enterpris':23B,49B,81C 'enterprise-erp':22B 'enterpriseon':4A,38B,73C,107C,130C,149C 'enterpriseone':20A 'erp':24B,25B 'exploit':93C 'expos':9A 'flaw':8A,46B 'h/a':173C 'h/i':172C 'host':33B 'http':57B,102C 'impact':161C 'infrastructur':50B,82C 'integr':160C 'jd':2A,18A,27B,36B,71C,78C,105C,128C,147C 'jd-edward':26B 'l/pr':168C 'modif':121C 'modifi':60B 'n':174C 'n/ac':167C 'n/s':170C 'n/ui':169C 'network':7A,99C 'oracl':1A,29B,35B,77C 'product':75C 'read':59B 'result':115C 'score':156C 'sec':51B,83C 'self':32B 'self-host':31B 'success':109C 'support':84C 'tool':5A,39B,74C,108C,131C,150C 'tools':21A 'u/c':171C 'unauthent':6A,54B,96C 'unauthor':117C,137C 'vector':163C 'vendor':34B 'version':40B,85C 'via':101C 'vulner':68C,94C,113C 'well':135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91265","severity":null,"published_at":"2026-10-20T22:20:27+00:00","modified_at":"2026-10-22T23:20:32+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91265:339","url":null,"severity":null,"published_at":"2026-10-23T22:58:39+00:00","modified_at":"2026-10-23T22:58:39+00:00","first_seen_at":"2026-10-23T22:58:39+00:00","fetched_at":"2026-10-23T22:58:39+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) is the primary source; affected range 9.2.0.0-9.2.26.5 confirmed via Oracle-sourced CVE record. I could not read the JD Edwards risk-matrix section (page truncated), so fixed version 9.2.26.6 comes from Armis only and the exact patch number is unconfirmed. No exploitation or PoC seen; I did not search X or other social sources."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1708,"url":"https://cve.armis.com/CVE-2026-91265","title":"Armis: CVE-2026-91265 (fixed version 9.2.26.6, workaround)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1709,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91265","title":"CVE Record: CVE-2026-91265 (Oracle CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}