{"id":"CVE-2026-91270","kind":"vulnerability","aliases":["CVE-2026-91270"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Monitoring and Diagnostics SEC component. A low-privileged user with HTTP network access can take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":[],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","self-hosted","vendor"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the Tools release shown at sign-on). Any release from 9.2.0.0 to 9.2.26.5 is affected if the Monitoring and Diagnostics component is reachable over HTTP.","fix":"Apply the Oct 2026 Critical Patch Update for JD Edwards EnterpriseOne Tools; see the JD Edwards patch availability doc on My Oracle Support for the exact Tools release (above 9.2.26.5; exact number not confirmed). Until patched, limit HTTP access to the Monitoring and Diagnostics component to trusted networks or VPN, which Armis suggests but which is not a full fix.","status":"open","published_at":"2026-10-20T22:20:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:10+00:00","updated_at":"2026-10-23T23:57:24+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:34:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Monitoring and Diagnostics component. A low-privileged user with network access over HTTP can fully compromise the product, per the CVSS 8.8 vector.","category":"vendor","who_cares":["jd-edwards","enterpriseone","oracle"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the EnterpriseOne Tools server, with full read, write and disruption","analyst_note":"Find the Oracle Critical Patch Update advisory for the patch level that fixes 9.2.26.5 and the Monitoring and Diagnostics SEC component; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-91270.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000521,"input_tokens":3107,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for the patch level that fixes 9.2.26.5 and the Monitoring and Diagnostics SEC component; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-91270.","search":"'-2026':14A,17A '-91270':15A,18A '/av':160C '2026':79B '3.1':68B,147C,159C '8.8':69B,150C '9.2.0.0':40B,112C '9.2.26.5':42B,113C 'access':61B,123C 'affect':110C 'allow':117C 'attack':120C,133C 'av':70B 'avail':154C 'base':148C 'compon':52B,101C 'compromis':127C 'confidenti':151C 'critic':80B 'cve':13A,16A 'cvss':67B,146C,156C,158C 'diagnost':50B,104C 'easili':114C 'edward':3A,26B,37B,93C,100C,129C,143C 'edwards':20A 'enterpriseon':4A,23B,38B,94C,130C,144C 'enterpriseone':21A 'exploit':84B,115C 'fix':75B 'flaw':45B 'found':88B 'h':168C 'h/a':167C 'h/i':166C 'host':33B 'http':59B,125C 'impact':155C 'integr':152C 'jd':2A,19A,25B,36B,92C,99C,128C,142C 'jd-edward':24B 'l/pr':72B,162C 'l/ui':73B,163C 'low':7A,55B,118C 'low-privileg':6A,54B 'monitor':48B,102C 'n':74B 'n/ac':71B,161C 'n/s':164C 'network':9A,60B,122C 'octob':78B 'on-prem':27B 'oracl':1A,30B,35B,98C 'patch':81B 'poc':87B 'prem':29B 'privileg':8A,56B,119C 'product':66B,96C 'public':86B 'result':138C 'score':149C 'sec':51B,105C 'self':32B 'self-host':31B 'success':132C 'support':106C 'take':12A,63B 'takeov':140C 'tool':5A,39B,95C,131C,145C 'tools':22A 'u/c':165C 'updat':82B 'user':10A,57B 'vector':157C 'vendor':34B 'version':107C 'via':124C 'vulner':89C,116C,136C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91270","severity":null,"published_at":"2026-10-20T22:20:28+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91270:554","url":null,"severity":null,"published_at":"2026-10-23T23:57:24+00:00","modified_at":"2026-10-23T23:57:24+00:00","first_seen_at":"2026-10-23T23:57:24+00:00","fetched_at":"2026-10-23T23:57:24+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5; NVD/CVE agree. Exact fixed Tools release is in the MOS patch availability doc (login required), not read. No exploitation or PoC found; no social search done (Oracle CPU, no discussion expected)."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2273,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91270","title":"NVD CVE-2026-91270","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2274,"url":"https://cve.armis.com/CVE-2026-91270","title":"Armis CVE-2026-91270","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}