---
id: "CVE-2026-91270"
kind: "vulnerability"
aliases: ["CVE-2026-91270"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over"
severity: "high"
cvss: 8.8
epss: 0.00447
exploited: false
status: "open"
category: "vendor"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": [], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterpriseone", "jd-edwards", "on-prem", "oracle", "self-hosted", "vendor"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:20:28+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91270", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:57:24+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91270", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Monitoring and Diagnostics SEC component. A low-privileged user with HTTP network access can take over the product (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). Fixed by the October 2026 Critical Patch Update. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed ?

## How to check

Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the Tools release shown at sign-on). Any release from 9.2.0.0 to 9.2.26.5 is affected if the Monitoring and Diagnostics component is reachable over HTTP.

## Fix

Apply the Oct 2026 Critical Patch Update for JD Edwards EnterpriseOne Tools; see the JD Edwards patch availability doc on My Oracle Support for the exact Tools release (above 9.2.26.5; exact number not confirmed). Until patched, limit HTTP access to the Monitoring and Diagnostics component to trusted networks or VPN, which Armis suggests but which is not a full fix.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91270
- 2026-10-23T23:57:24+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5; NVD/CVE agree. Exact fixed Tools release is in the MOS patch availability doc (login required), not read. No exploitation or PoC found; no social search done (Oracle CPU, no discussion expected).
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91270

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] NVD CVE-2026-91270 https://nvd.nist.gov/vuln/detail/CVE-2026-91270
- [mitigation] Armis CVE-2026-91270 https://cve.armis.com/CVE-2026-91270

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_