{"id":"CVE-2026-91278","kind":"vulnerability","aliases":["CVE-2026-91278"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privileged user reads protected data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle's JD Edwards EnterpriseOne Tools release 9.2 has a flaw in its Monitoring and Diagnostics component. A user with a low-privileged logon on the host where the tools run can gain unauthorized access to critical data in the product.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","erp","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Confirm whether the EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, as stated in the NVD entry.\n- Check the Oracle Security Alert or Critical Patch Update for CVE-2026-91278 for the patched level: unknown from the sources.","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers CVE-2026-91278: unknown from the sources.\n- Move to a supported EnterpriseOne Tools release above 9.2.26.5: unknown from the sources.","status":"open","published_at":"2026-10-20T22:20:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:12:08+00:00","updated_at":"2026-10-25T04:12:08+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:12:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers CVE-2026-91278: unknown from the sources.\n- Move to a supported EnterpriseOne Tools release above 9.2.26.5: unknown from the sources.","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: low-privileged user reads protected data","impact":"medium","summary":"Oracle's JD Edwards EnterpriseOne Tools release 9.2 has a flaw in its Monitoring and Diagnostics component. A user with a low-privileged logon on the host where the tools run can gain unauthorized access to critical data in the product.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","on-prem","erp"],"confidence":0.5,"needs_auth":"yes","worst_case":"Low-privileged local user reads critical EnterpriseOne data","analyst_note":"Find the Oracle Security Alert or CPU entry for CVE-2026-91278 to get the patched release and any workaround for Monitoring and Diagnostics SEC.","how_to_check":"- Confirm whether the EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, as stated in the NVD entry.\n- Check the Oracle Security Alert or Critical Patch Update for CVE-2026-91278 for the patched level: unknown from the sources.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 are affected, where local users with logon to the server can reach the Monitoring and Diagnostics component. The sources do not describe a network-only path, so teams that run no shared logons on these hosts face lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3524,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91278':15A,18A '/av':155C '3.1':145C,154C '5.5':148C '9.2':36B '9.2.0.0':94C '9.2.26.5':95C 'access':64B,129C,135C,142C 'affect':92C 'allow':99C 'attack':102C,121C 'base':146C 'complet':134C 'compon':45B,83C 'compromis':115C 'confidenti':149C 'critic':66B,131C 'cve':13A,16A 'cvss':144C,151C,153C 'data':12A,67B,132C,143C 'diagnost':44B,86C 'easili':96C 'edward':3A,23B,32B,75C,82C,110C,117C,139C 'enterpriseon':4A,19B,33B,76C,111C,118C,140C 'erp':20B 'execut':113C 'exploit':97C 'flaw':39B 'gain':62B 'h/i':161C 'host':56B 'impact':150C 'infrastructur':107C 'jd':2A,22B,31B,74C,81C,109C,116C,138C 'jd-edward':21B 'l/ac':156C 'l/pr':157C 'l/ui':158C 'logon':53B,104C 'low':7A,51B,100C 'low-privileg':6A,50B 'monitor':42B,84C 'n':163C 'n/a':162C 'n/s':159C 'on-prem':24B 'oracl':1A,27B,29B,80C 'prem':26B 'privileg':8A,52B,101C 'product':70B,78C 'protect':11A 'read':10A 'releas':35B 'result':126C 'run':60B 'score':147C 'sec':87C 'success':120C 'support':88C 'tool':5A,34B,59B,77C,112C,119C,141C 'u/c':160C 'unauthor':63B,128C 'user':9A,47B 'vector':152C 'vendor':28B 'version':89C 'vulner':71C,98C,124C","nicknames":[],"mitigations":[],"who_affected":"Sites running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 are affected, where local users with logon to the server can reach the Monitoring and Diagnostics component. The sources do not describe a network-only path, so teams that run no shared logons on these hosts face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91278","severity":null,"published_at":"2026-10-20T22:20:29+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}