{"id":"CVE-2026-91290","kind":"vulnerability","aliases":["CVE-2026-91290"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege user reads protected data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Web Runtime SEC component. A user with a low-privilege logon on the host where the tools run can gain unauthorized access to critical data in the product.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","erp","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["version-outside-range"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0-9.2.26.5 using the Oracle JD Edwards release report or the tools version shown in the installation\n- unknown for any other check, since the sources do not describe one","fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component; the fixed release is unknown from the sources","status":"open","published_at":"2026-10-20T22:20:30+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:12:08+00:00","updated_at":"2026-10-25T04:12:08+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:12:08Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component; the fixed release is unknown from the sources","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege user reads protected data","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Web Runtime SEC component. A user with a low-privilege logon on the host where the tools run can gain unauthorized access to critical data in the product.","category":"vendor","nicknames":[],"who_cares":["oracle","jd-edwards","enterpriseone","on-prem","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated low-privilege user reads critical JD Edwards data","analyst_note":"Find the fixed EnterpriseOne Tools release and patch level for the Web Runtime SEC component in the Oracle Critical Patch Update advisory.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0-9.2.26.5 using the Oracle JD Edwards release report or the tools version shown in the installation\n- unknown for any other check, since the sources do not describe one","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0-9.2.26.5 range, where an authenticated low-privilege user can log on to the server infrastructure. Deployments where no such users exist have a much smaller exposure. Systems outside that version range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":3521,"output_tokens":646,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91290':15A,18A '/av':154C '3.1':144C,153C '5.5':147C '9.2.0.0':34B,93C '9.2.26.5':36B,94C 'access':64B,128C,134C,141C 'affect':91C 'allow':98C 'attack':101C,120C 'base':145C 'complet':133C 'compon':45B,83C 'compromis':114C 'confidenti':148C 'critic':66B,130C 'cve':13A,16A 'cvss':143C,150C,152C 'data':12A,67B,131C,142C 'easili':95C 'edward':3A,23B,31B,75C,82C,109C,116C,138C 'enterpriseon':4A,19B,32B,76C,110C,117C,139C 'erp':20B 'execut':112C 'exploit':96C 'flaw':39B 'gain':62B 'h/i':160C 'host':56B 'impact':149C 'infrastructur':106C 'jd':2A,22B,30B,74C,81C,108C,115C,137C 'jd-edward':21B 'l/ac':155C 'l/pr':156C 'l/ui':157C 'logon':53B,103C 'low':7A,51B,99C 'low-privileg':6A,50B 'n':162C 'n/a':161C 'n/s':158C 'on-prem':24B 'oracl':1A,27B,29B,80C 'prem':26B 'privileg':8A,52B,100C 'product':70B,78C 'protect':11A 'read':10A 'result':125C 'run':60B 'runtim':43B,85C 'score':146C 'sec':44B,86C 'success':119C 'support':87C 'tool':5A,33B,59B,77C,111C,118C,140C 'u/c':159C 'unauthor':63B,127C 'user':9A,47B 'vector':151C 'vendor':28B 'version':88C 'vulner':71C,97C,123C 'web':42B,84C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0-9.2.26.5 range, where an authenticated low-privilege user can log on to the server infrastructure. Deployments where no such users exist have a much smaller exposure. Systems outside that version range are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91290","severity":null,"published_at":"2026-10-20T22:20:30+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}