How do I check whether I am affected by CVE-2026-91266?

- Check the installed EnterpriseOne Tools release against `9.2.0.0` through `9.2.26.5` in the Oracle advisory for your release - unknown whether the sources name a specific file or setting to inspect

What is the fix for CVE-2026-91266?

- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools, moving past `9.2.26.5` - unknown exact patched version in the sources

Who is not affected by CVE-2026-91266?

Not affected if: no-untrusted-local-logon, patched-release.

Live › vulnerability › CVE-2026-91266

Go to dashboard

high8.4Infrastructure

Oracle JD Edwards EnterpriseOne Tools: low-privileged logon can compromise data

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Monitoring and Diagnostics component. An attacker with a low-privileged logon to the host where the tools run can create, change or delete critical data and read data the product can access.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker alters or deletes critical data and reads accessible data.
CVSS said: 8.4. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

JD Edwards EnterpriseOne Tools installations on versions 9.2.0.0 through 9.2.26.5 are affected. The attacker needs a logon on the infrastructure where the tools execute, so exposure depends on who holds local accounts on those hosts. Installations on newer releases, or without local logon access for untrusted users, can deprioritize it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91266

Go to dashboard

high8.4Infrastructure

Oracle JD Edwards EnterpriseOne Tools: low-privileged logon can compromise data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Attacker alters or deletes critical data and reads accessible data.
CVSS said: 8.4. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle JD Edwards EnterpriseOne Tools: low-privileged logon can compromise data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle JD Edwards EnterpriseOne Tools: low-privileged logon can compromise data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources