{"id":"CVE-2026-91274","kind":"vulnerability","aliases":["CVE-2026-91274"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: monitoring flaw exposes data over HTTP","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Monitoring and Diagnostics component. An unauthenticated attacker with network access over HTTP can read critical data and change or delete some accessible data, though exploitation is difficult.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["unsupported-version"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0-9.2.26.5 in the vendor's version records.\n- unknown for other checks; the sources do not say which configuration or endpoint is involved.","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-91274 for JD Edwards EnterpriseOne Tools; the sources do not name the fixed release.\n- Restrict HTTP access to the Monitoring and Diagnostics component to trusted networks until patched.","status":"open","published_at":"2026-10-20T22:20:28+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:51:04+00:00","updated_at":"2026-10-25T03:51:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:51:04Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-91274 for JD Edwards EnterpriseOne Tools; the sources do not name the fixed release.\n- Restrict HTTP access to the Monitoring and Diagnostics component to trusted networks until patched.","reach":"internet","title":"Oracle JD Edwards EnterpriseOne Tools: monitoring flaw exposes data over HTTP","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Monitoring and Diagnostics component. An unauthenticated attacker with network access over HTTP can read critical data and change or delete some accessible data, though exploitation is difficult.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads critical data and alters some accessible records","analyst_note":"Find the fixed release and patch name in Oracle's advisory for CVE-2026-91274 and confirm whether the Monitoring and Diagnostics component is enabled by default.","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0-9.2.26.5 in the vendor's version records.\n- unknown for other checks; the sources do not say which configuration or endpoint is involved.","needs_analyst":true,"not_affected_if":["unsupported-version"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range with the Monitoring and Diagnostics component reachable over the network. The sources do not say whether default configuration is exposed, so unknown whether internal-only deployments are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":3551,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91274':14A,17A '/av':165C '3.1':153C,164C '6.5':156C '9.2.0.0':32B,90C '9.2.26.5':34B,91C 'access':49B,61B,101C,119C,125C,132C,142C,150C 'affect':88C 'allow':96C 'attack':46B,98C,111C 'base':154C 'chang':57B 'complet':124C 'compon':43B,79C 'compromis':105C 'confidenti':157C 'critic':54B,121C 'cve':12A,15A 'cvss':152C,161C,163C 'data':9A,55B,62B,122C,133C,151C 'delet':59B,141C 'diagnost':42B,82C 'difficult':66B,92C 'edward':3A,21B,29B,71C,78C,107C,129C,147C 'enterpriseon':4A,18B,30B,72C,108C,130C,148C 'exploit':64B,94C 'expos':8A 'flaw':7A,37B 'h/i':171C 'h/pr':167C 'host':25B 'http':11A,51B,103C 'impact':160C 'insert':139C 'integr':159C 'jd':2A,20B,28B,70C,77C,106C,128C,146C 'jd-edward':19B 'l/a':172C 'monitor':6A,40B,80C 'n':173C 'n/ac':166C 'n/s':169C 'n/ui':168C 'network':48B,100C 'oracl':1A,22B,27B,76C 'product':74C 'read':53B 'result':116C 'score':155C 'sec':83C 'self':24B 'self-host':23B 'success':110C 'support':84C 'though':63B 'tool':5A,31B,73C,109C,131C,149C 'u/c':170C 'unauthent':45B,97C 'unauthor':118C,137C 'updat':138C 'vector':162C 'vendor':26B 'version':85C 'via':102C 'vulner':67C,95C,114C 'well':135C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range with the Monitoring and Diagnostics component reachable over the network. The sources do not say whether default configuration is exposed, so unknown whether internal-only deployments are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91274","severity":null,"published_at":"2026-10-20T22:20:28+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}