---
id: "CVE-2026-91278"
kind: "vulnerability"
aliases: ["CVE-2026-91278"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privileged user reads protected data"
severity: "medium"
cvss: 5.5
epss: 0.00145
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "erp", "jd-edwards", "on-prem", "oracle", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T22:20:29+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91278", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91278", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privileged user reads protected data

Oracle's JD Edwards EnterpriseOne Tools release 9.2 has a flaw in its Monitoring and Diagnostics component. A user with a low-privileged logon on the host where the tools run can gain unauthorized access to critical data in the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, as stated in the NVD entry.
- Check the Oracle Security Alert or Critical Patch Update for CVE-2026-91278 for the patched level: unknown from the sources.

## Fix

- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers CVE-2026-91278: unknown from the sources.
- Move to a supported EnterpriseOne Tools release above 9.2.26.5: unknown from the sources.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91278
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91278

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_