{"id":"CVE-2026-91283","kind":"vulnerability","aliases":["CVE-2026-91283"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: Web Runtime flaw leaks some stored data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Web Runtime SEC component, has a flaw reachable over HTTP without a login. A remote attacker who tricks a logged-in user into acting can read a subset of data the tools make accessible.","severity":"medium","cvss":4.3,"epss":0.00213,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["no-web-runtime-exposure","unsupported-version"],"how_to_check":"- Identify whether JD Edwards EnterpriseOne Tools is installed and check its release against Oracle's advisory for affected versions 9.2.0.0-9.2.26.5.\n- unknown for any other check; the sources do not name a file, setting or command.","fix":"- Move JD Edwards EnterpriseOne Tools to a release patched by Oracle's Critical Patch Update for this CVE; the fixed version is unknown in the sources.\n- Apply the Oracle patch and restart the web runtime.","status":"open","published_at":"2026-10-20T22:20:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:39:03+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:39:03Z","model":"claude-haiku-5-5","output":{"fix":"- Move JD Edwards EnterpriseOne Tools to a release patched by Oracle's Critical Patch Update for this CVE; the fixed version is unknown in the sources.\n- Apply the Oracle patch and restart the web runtime.","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: Web Runtime flaw leaks some stored data","impact":"low","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Web Runtime SEC component, has a flaw reachable over HTTP without a login. A remote attacker who tricks a logged-in user into acting can read a subset of data the tools make accessible.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads a subset of accessible EnterpriseOne data","analyst_note":"","how_to_check":"- Identify whether JD Edwards EnterpriseOne Tools is installed and check its release against Oracle's advisory for affected versions 9.2.0.0-9.2.26.5.\n- unknown for any other check; the sources do not name a file, setting or command.","needs_analyst":false,"not_affected_if":["unsupported-version","no-web-runtime-exposure"],"who_is_affected":"Sites running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range, where the Web Runtime is reachable over HTTP from the network. Exposure requires a person other than the attacker to take an action, so internal-only deployments with no web access from outside carry less risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3518,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91283':15A,18A '/av':155C '3.1':145C,154C '4.3':148C '9.2.0.0':92C '9.2.26.5':93C 'access':69B,102C,133C,142C 'act':59B 'affect':90C 'allow':97C 'attack':50B,99C,112C,122C,124C 'base':146C 'compon':38B,82C 'compromis':106C 'confidenti':149C 'cve':13A,16A 'cvss':144C,151C,153C 'data':12A,65B,143C 'easili':94C 'edward':3A,22B,30B,74C,81C,108C,139C 'enterpriseon':4A,19B,31B,75C,109C,140C 'exploit':95C 'flaw':8A,41B 'host':26B 'http':44B,104C 'human':114C 'impact':150C 'interact':115C 'jd':2A,21B,29B,73C,80C,107C,138C 'jd-edward':20B 'l/i':161C 'l/pr':157C 'leak':9A 'log':55B 'logged-in':54B 'login':47B 'make':68B 'n':163C 'n/a':162C 'n/ac':156C 'n/ui':158C 'network':101C 'oracl':1A,23B,28B,79C 'person':118C 'product':77C 'r/s':159C 'reachabl':42B 'read':61B,132C 'remot':49B 'requir':113C 'result':129C 'runtim':7A,36B,84C 'score':147C 'sec':37B,85C 'self':25B 'self-host':24B 'store':11A 'subset':63B,136C 'success':111C,123C 'support':86C 'tool':5A,32B,67B,76C,110C,141C 'trick':52B 'u/c':160C 'unauthent':98C 'unauthor':131C 'user':57B 'vector':152C 'vendor':27B 'version':87C 'via':103C 'vulner':70C,96C,127C 'web':6A,35B,83C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Sites running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range, where the Web Runtime is reachable over HTTP from the network. Exposure requires a person other than the attacker to take an action, so internal-only deployments with no web access from outside carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91283","severity":null,"published_at":"2026-10-20T22:20:29+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91283","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91283","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}