{"id":"CVE-2026-91268","kind":"vulnerability","aliases":["CVE-2026-91268"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: web runtime flaw enables full takeover","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.5, Web Runtime SEC component: a low-privileged user with HTTP access can take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A high; CWE-269 per VulDB). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.","severity":"high","cvss":8.8,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":[],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterpriseone","jd-edwards","oracle","other","package","self-hosted","web-runtime"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Find your E1 Tools release (Server Manager console or the Tools release shown in the E1 sign-on/About page). Any release from 9.2.0.0 through 9.2.26.5 is affected. Check whether the HTML/web server is reachable by any authenticated user.","fix":"Apply the October 2026 CPU patch for JD Edwards EnterpriseOne Tools via My Oracle Support (JD Edwards patch availability document linked from cpuoct2026.html). Third-party summaries say the fixed release is 9.2.26.6 or later, but Oracle's public page does not state it; confirm in MOS. Until patched, restrict network access to the E1 web tier.","status":"open","published_at":"2026-10-20T22:20:27+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:10+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:34:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: web runtime flaw enables full takeover","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Web Runtime SEC component that is reachable over HTTP. A low-privileged user with network access can take over the product, with high confidentiality, integrity and availability impact.","category":"package","who_cares":["jd-edwards","enterpriseone","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the EnterpriseOne Tools server and reads or changes all data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched build and the exact fixed version after 9.2.26.5 at https://nvd.nist.gov/vuln/detail/CVE-2026-91268.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000512,"input_tokens":3108,"output_tokens":403,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched build and the exact fixed version after 9.2.26.5 at https://nvd.nist.gov/vuln/detail/CVE-2026-91268.","search":"'-2026':13A,16A '-269':70B '-91268':14A,17A '/av':155C '2026':78B '3.1':60B,142C,154C '8.8':61B,145C '9.2.0.0':40B,107C '9.2.26.5':41B,108C 'access':53B,118C 'affect':105C 'allow':112C 'attack':115C,128C 'av':62B 'avail':149C 'base':143C 'c/i/a':67B 'compon':45B,97C 'compromis':122C 'confidenti':146C 'critic':79B 'cve':12A,15A 'cvss':59B,141C,151C,153C 'cwe':69B 'easili':109C 'edward':3A,25B,37B,89C,96C,124C,138C 'edwards':19A 'enabl':9A 'enterpriseon':4A,22B,38B,90C,125C,139C 'enterpriseone':20A 'exploit':84B,110C 'fix':73B 'flaw':8A 'full':10A 'h':163C 'h/a':162C 'h/i':161C 'high':68B 'host':31B 'http':52B,120C 'impact':150C 'integr':147C 'jd':2A,18A,24B,36B,88C,95C,123C,137C 'jd-edward':23B 'known':83B 'l/pr':64B,157C 'l/ui':65B,158C 'low':48B,113C 'low-privileg':47B 'n':66B 'n/ac':63B,156C 'n/s':159C 'network':117C 'octob':77B 'oracl':1A,26B,35B,75B,94C 'packag':28B 'patch':80B 'per':71B 'privileg':49B,114C 'product':58B,92C 'result':133C 'runtim':7A,34B,43B,99C 'score':144C 'sec':44B,100C 'self':30B 'self-host':29B 'success':127C 'support':101C 'take':55B 'takeov':11A,135C 'tool':5A,39B,91C,126C,140C 'tools':21A 'u/c':160C 'updat':81B 'user':50B 'vector':152C 'version':102C 'via':119C 'vuldb':72B 'vulner':85C,111C,131C 'web':6A,33B,42B,98C 'web-runtim':32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91268","severity":null,"published_at":"2026-10-20T22:20:27+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91268:555","url":null,"severity":null,"published_at":"2026-10-23T23:57:23+00:00","modified_at":"2026-10-23T23:57:23+00:00","first_seen_at":"2026-10-23T23:57:23+00:00","fetched_at":"2026-10-23T23:57:23+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 as affected; patch details are in the My Oracle Support JD Edwards patch availability doc (login-gated, not read). Fixed version 9.2.26.6 appears only in Armis' reading, not Oracle's page, so it is unconfirmed. No exploitation or PoC found in Armis/VulDB; X/HN not searched."},{"source":"epss","external_id":"CVE-2026-91268","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91268","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2271,"url":"https://cve.armis.com/CVE-2026-91268","title":"Armis CVE-2026-91268","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}