---
id: "CVE-2026-91268"
kind: "vulnerability"
aliases: ["CVE-2026-91268"]
title: "Oracle JD Edwards EnterpriseOne Tools: web runtime flaw enables full takeover"
severity: "high"
cvss: 8.8
epss: 0.00328
exploited: false
status: "open"
category: "package"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": [], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterpriseone", "jd-edwards", "oracle", "other", "package", "self-hosted", "web-runtime"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:20:27+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91268", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:57:23+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91268", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: web runtime flaw enables full takeover

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.5, Web Runtime SEC component: a low-privileged user with HTTP access can take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A high; CWE-269 per VulDB). Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed ?

## How to check

Find your E1 Tools release (Server Manager console or the Tools release shown in the E1 sign-on/About page). Any release from 9.2.0.0 through 9.2.26.5 is affected. Check whether the HTML/web server is reachable by any authenticated user.

## Fix

Apply the October 2026 CPU patch for JD Edwards EnterpriseOne Tools via My Oracle Support (JD Edwards patch availability document linked from cpuoct2026.html). Third-party summaries say the fixed release is 9.2.26.6 or later, but Oracle's public page does not state it; confirm in MOS. Until patched, restrict network access to the E1 web tier.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91268
- 2026-10-23T23:57:23+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 as affected; patch details are in the My Oracle Support JD Edwards patch availability doc (login-gated, not read). Fixed version 9.2.26.6 appears only in Armis' reading, not Oracle's page, so it is unconfirmed. No exploitation or PoC found in Armis/VulDB; X/HN not searched.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91268

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] Armis CVE-2026-91268 https://cve.armis.com/CVE-2026-91268

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_