---
id: "CVE-2026-91285"
kind: "vulnerability"
aliases: ["CVE-2026-91285"]
title: "Oracle JD Edwards EnterpriseOne Orchestrator: low-privilege users can read critical data"
severity: "medium"
cvss: 6.5
epss: 0.00355
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "jd-edwards", "oracle", "self-hosted", "vendor"]
not_affected_if: ["version-outside-range"]
published_at: "2026-10-20T22:20:29+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91285", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91285", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Orchestrator: low-privilege users can read critical data

Oracle JD Edwards EnterpriseOne Orchestrator, in the E1 IoT Orchestrator Security component, is affected in versions 9.2.0.0 through 9.2.26.5. An attacker with a low-privilege account and network access over HTTP can gain unauthorized access to critical data and all data the Orchestrator can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed JD Edwards EnterpriseOne Orchestrator version against the affected range `9.2.0.0` to `9.2.26.5`
- Confirm with the Oracle JD Edwards admin which E1 IoT Orchestrator Security patch level is deployed

## Fix

- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Orchestrator, moving past `9.2.26.5` (the exact patched version is unknown from the sources)

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91285
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91285

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_