---
id: "CVE-2026-91265"
kind: "vulnerability"
aliases: ["CVE-2026-91265"]
title: "Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical data"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": ["9.2.26.6"], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-erp", "erp", "jd-edwards", "oracle", "other", "self-hosted", "vendor"]
not_affected_if: ["default-config", "not-internet-exposed"]
published_at: "2026-10-20T22:20:27+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-23T22:58:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91265", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:58:39+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical data

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Enterprise Infrastructure SEC component. An unauthenticated attacker over HTTP can read, modify, or delete data the application can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed 9.2.26.6

## How to check

Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the Tools release shown at sign-on/About). Exposed if it is 9.2.0.0 through 9.2.26.5 and the JDE HTTP endpoints (web server/AIS) are reachable by an attacker.

## Fix

Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support; Armis reports fixed in Tools 9.2.26.6 or later (not confirmed on Oracle's page). Workaround, per Armis only: restrict JDE HTTP endpoints at firewall/load balancer to trusted IP ranges; this does not remove the flaw for allowed networks.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91265
- 2026-10-23T22:58:39+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) is the primary source; affected range 9.2.0.0-9.2.26.5 confirmed via Oracle-sourced CVE record. I could not read the JD Edwards risk-matrix section (page truncated), so fixed version 9.2.26.6 comes from Armis only and the exact patch number is unconfirmed. No exploitation or PoC seen; I did not search X or other social sources.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91265 (Oracle CNA) https://www.cve.org/CVERecord?id=CVE-2026-91265
- [mitigation] Armis: CVE-2026-91265 (fixed version 9.2.26.6, workaround) https://cve.armis.com/CVE-2026-91265

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_