{"id":"CVE-2026-91282","kind":"vulnerability","aliases":["CVE-2026-91282"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: Portal SEC flaw exposes data over HTTP","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Portal SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Portal SEC component. An unauthenticated attacker with network access over HTTP may read critical data the product can reach, though exploitation is hard.","severity":"medium","cvss":5.9,"epss":0.00318,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["not-jd-edwards"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:08:14+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:08:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: Portal SEC flaw exposes data over HTTP","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Portal SEC component. An unauthenticated attacker with network access over HTTP may read critical data the product can reach, though exploitation is hard.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker reads critical data in EnterpriseOne","analyst_note":"Find Oracle's Critical Patch Update advisory and the patched EnterpriseOne Tools release that fixes Portal SEC for versions 9.2.0.0-9.2.26.5.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-jd-edwards"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 with the Portal SEC component reachable over HTTP. The sources do not say which configurations expose the component, so teams without this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3496,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91282':15A,18A '/av':141C '3.1':131C,140C '5.9':134C '9.2.0.0':34B,86C '9.2.26.5':36B,87C 'access':50B,97C,115C,121C,128C 'affect':84C 'allow':92C 'attack':47B,94C,107C 'base':132C 'complet':120C 'compon':44B,77C 'compromis':101C 'confidenti':135C 'critic':55B,117C 'cve':13A,16A 'cvss':130C,137C,139C 'data':10A,56B,118C,129C 'difficult':88C 'edward':3A,22B,30B,69C,76C,103C,125C 'enterpriseon':4A,19B,31B,70C,104C,126C 'exploit':62B,90C 'expos':9A 'flaw':8A,39B 'h/i':147C 'h/pr':143C 'hard':64B 'host':26B 'http':12A,52B,99C 'impact':136C 'jd':2A,21B,29B,68C,75C,102C,124C 'jd-edward':20B 'may':53B 'n':149C 'n/a':148C 'n/ac':142C 'n/s':145C 'n/ui':144C 'network':49B,96C 'oracl':1A,23B,28B,74C 'portal':6A,42B,78C 'product':58B,72C 'reach':60B 'read':54B 'result':112C 'score':133C 'sec':7A,43B,79C 'self':25B 'self-host':24B 'success':106C 'support':80C 'though':61B 'tool':5A,32B,71C,105C,127C 'u/c':146C 'unauthent':46B,93C 'unauthor':114C 'vector':138C 'vendor':27B 'version':33B,81C 'via':98C 'vulner':65C,91C,110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 with the Portal SEC component reachable over HTTP. The sources do not say which configurations expose the component, so teams without this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91282","severity":null,"published_at":"2026-10-20T22:20:29+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91282","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91282","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}