{"id":"CVE-2026-91284","kind":"vulnerability","aliases":["CVE-2026-91284"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege user can crash server via JDENET","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools on UNIX, versions 9.2.0.0 through 9.2.26.5, can be made to hang or repeatedly crash by a low-privileged user sending requests over JDENET. The sources describe an availability impact only, with no confidentiality or integrity loss.","severity":"medium","cvss":6.5,"epss":0.00289,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","other","unix"],"not_affected_if":["non-unix-platform","unaffected-release"],"how_to_check":"- Check the installed EnterpriseOne Tools release level against `9.2.0.0` through `9.2.26.5` on UNIX servers\n- unknown","fix":"- Move EnterpriseOne Tools on UNIX to a release newer than `9.2.26.5` as listed in Oracle's advisory\n- unknown","status":"open","published_at":"2026-10-20T22:20:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:51:02+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:51:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move EnterpriseOne Tools on UNIX to a release newer than `9.2.26.5` as listed in Oracle's advisory\n- unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege user can crash server via JDENET","impact":"low","summary":"Oracle JD Edwards EnterpriseOne Tools on UNIX, versions 9.2.0.0 through 9.2.26.5, can be made to hang or repeatedly crash by a low-privileged user sending requests over JDENET. The sources describe an availability impact only, with no confidentiality or integrity loss.","category":"other","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone","unix"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service hangs or repeatedly crashes, causing denial of service.","analyst_note":"Confirm the fixed release and the exact JDENET exposure from Oracle's Critical Patch Update advisory, since the NVD entry gives no fix version.","how_to_check":"- Check the installed EnterpriseOne Tools release level against `9.2.0.0` through `9.2.26.5` on UNIX servers\n- unknown","needs_analyst":true,"not_affected_if":["non-unix-platform","unaffected-release"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 on UNIX where users can reach the JDENET service. The sources do not say which deployments are most exposed beyond the network path and low privilege requirement.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":3518,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91284':17A,20A '/av':150C '3.1':140C,149C '6.5':143C '9.2.0.0':36B,94C '9.2.26.5':38B,95C 'abil':123C 'access':105C 'affect':92C 'allow':99C 'attack':102C,115C 'avail':61B,144C 'base':141C 'caus':125C 'complet':132C 'compon':82C 'compromis':109C 'confidenti':66B 'crash':11A,46B,131C 'cve':15A,18A 'cvss':139C,146C,148C 'describ':59B 'dev':84C 'dos':133C 'e1':83C 'easili':96C 'edward':3A,24B,30B,74C,81C,111C,136C 'enterpriseon':4A,21B,31B,75C,112C,137C 'exploit':97C 'frequent':129C 'h':158C 'hang':43B,127C 'impact':62B,145C 'integr':68B 'jd':2A,23B,29B,73C,80C,110C,135C 'jd-edward':22B 'jdenet':14A,56B,107C 'l/pr':152C 'l/ui':153C 'loss':69B 'low':7A,50B,100C 'low-privileg':6A,49B 'made':41B 'n/a':157C 'n/ac':151C 'n/i':156C 'n/s':154C 'network':104C 'oracl':1A,25B,28B,79C 'platform':85C 'privileg':8A,51B,101C 'product':77C 'repeat':45B,130C 'request':54B 'result':120C 'score':142C 'send':53B 'server':12A 'sourc':58B 'success':114C 'support':88C 'tech':86C 'tool':5A,32B,76C,113C,138C 'u/c':155C 'unauthor':122C 'unix':27B,34B,87C 'user':9A,52B 'vector':147C 'version':35B,89C 'via':13A,106C 'vulner':70C,98C,118C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 on UNIX where users can reach the JDENET service. The sources do not say which deployments are most exposed beyond the network path and low privilege requirement.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91284","severity":null,"published_at":"2026-10-20T22:20:29+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91284","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91284","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}