---
id: "CVE-2026-91290"
kind: "vulnerability"
aliases: ["CVE-2026-91290"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege user reads protected data"
severity: "medium"
cvss: 5.5
epss: 0.00145
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "erp", "jd-edwards", "on-prem", "oracle", "vendor"]
not_affected_if: ["version-outside-range"]
published_at: "2026-10-20T22:20:30+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91290", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91290", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege user reads protected data

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Web Runtime SEC component. A user with a low-privilege logon on the host where the tools run can gain unauthorized access to critical data in the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0-9.2.26.5 using the Oracle JD Edwards release report or the tools version shown in the installation
- unknown for any other check, since the sources do not describe one

## Fix

- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component; the fixed release is unknown from the sources

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91290
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91290

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_