{"id":"CVE-2026-91285","kind":"vulnerability","aliases":["CVE-2026-91285"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Orchestrator: low-privilege users can read critical data","description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle JD Edwards EnterpriseOne Orchestrator, in the E1 IoT Orchestrator Security component, is affected in versions 9.2.0.0 through 9.2.26.5. An attacker with a low-privilege account and network access over HTTP can gain unauthorized access to critical data and all data the Orchestrator can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed JD Edwards EnterpriseOne Orchestrator version against the affected range `9.2.0.0` to `9.2.26.5`\n- Confirm with the Oracle JD Edwards admin which E1 IoT Orchestrator Security patch level is deployed","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Orchestrator, moving past `9.2.26.5` (the exact patched version is unknown from the sources)","status":"open","published_at":"2026-10-20T22:20:29+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:51:02+00:00","updated_at":"2026-10-25T03:51:02+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:51:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Orchestrator, moving past `9.2.26.5` (the exact patched version is unknown from the sources)","reach":"network","title":"Oracle JD Edwards EnterpriseOne Orchestrator: low-privilege users can read critical data","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Orchestrator, in the E1 IoT Orchestrator Security component, is affected in versions 9.2.0.0 through 9.2.26.5. An attacker with a low-privilege account and network access over HTTP can gain unauthorized access to critical data and all data the Orchestrator can reach.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical and orchestrator-accessible data over HTTP","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-91285 to confirm the patched version and any configuration prerequisites.","how_to_check":"- Check the installed JD Edwards EnterpriseOne Orchestrator version against the affected range `9.2.0.0` to `9.2.26.5`\n- Confirm with the Oracle JD Edwards admin which E1 IoT Orchestrator Security patch level is deployed","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running JD Edwards EnterpriseOne Orchestrator in the affected 9.2 release range that expose its HTTP interface to a network where low-privilege users sit. Installations on versions outside 9.2.0.0 through 9.2.26.5 are not listed as affected. The sources do not say whether the flaw depends on a specific Orchestrator feature being enabled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":3513,"output_tokens":702,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91285':16A,19A '/av':153C '3.1':143C,152C '6.5':146C '9.2.0.0':45B,98C '9.2.26.5':47B,99C 'access':58B,64B,109C,127C,133C,140C 'account':55B 'affect':42B,96C 'allow':103C 'attack':49B,106C,119C 'base':144C 'complet':132C 'compon':40B,87C 'compromis':113C 'confidenti':147C 'critic':12A,66B,129C 'cve':14A,17A 'cvss':142C,149C,151C 'data':13A,67B,70B,130C,141C 'e1':36B,88C 'easili':100C 'edward':3A,23B,31B,79C,86C,115C,137C 'enterpriseon':4A,20B,32B,80C,116C,138C 'exploit':101C 'gain':62B 'h/i':159C 'host':27B 'http':60B,111C 'impact':148C 'iot':37B,89C 'jd':2A,22B,30B,78C,85C,114C,136C 'jd-edward':21B 'l/pr':155C 'l/ui':156C 'low':7A,53B,104C 'low-privileg':6A,52B 'n':161C 'n/a':160C 'n/ac':154C 'n/s':157C 'network':57B,108C 'oracl':1A,24B,29B,84C 'orchestr':5A,33B,38B,72B,81C,90C,117C,139C 'privileg':8A,54B,105C 'product':82C 'reach':74B 'read':11A 'result':124C 'score':145C 'secur':39B,91C 'self':26B 'self-host':25B 'success':118C 'support':92C 'u/c':158C 'unauthor':63B,126C 'user':9A 'vector':150C 'vendor':28B 'version':44B,93C 'via':110C 'vulner':75C,102C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running JD Edwards EnterpriseOne Orchestrator in the affected 9.2 release range that expose its HTTP interface to a network where low-privilege users sit. Installations on versions outside 9.2.0.0 through 9.2.26.5 are not listed as affected. The sources do not say whether the flaw depends on a specific Orchestrator feature being enabled.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91285","severity":null,"published_at":"2026-10-20T22:20:29+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}