{"id":"CVE-2026-91292","kind":"vulnerability","aliases":["CVE-2026-91292"],"related":[],"title":"Oracle JD Edwards EnterpriseOne LATAM localizations: read access and partial denial of service","description":"Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD Edwards (component: LATAM).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Localizations.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Localizations accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Localizations. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).","summary":"Oracle JD Edwards EnterpriseOne Localizations 9.2 (LATAM component) has a flaw reachable over the network through JDENET. A low-privileged user can read a subset of accessible data and partly disrupt the service.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","erp","jd-edwards","oracle","vendor"],"not_affected_if":["jdenet-not-reachable","product-not-deployed"],"how_to_check":"- Confirm whether JD Edwards EnterpriseOne Localizations version `9.2` with the LATAM component is deployed.\n- unknown for further checks; the sources do not give specific configuration or file paths.","fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Localizations (LATAM) that addresses this CVE; the sources do not name the patched version.\n- unknown for the exact patch identifier.","status":"open","published_at":"2026-10-20T22:20:30+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:14:53+00:00","updated_at":"2026-10-25T04:14:53+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:14:53Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Localizations (LATAM) that addresses this CVE; the sources do not name the patched version.\n- unknown for the exact patch identifier.","reach":"network","title":"Oracle JD Edwards EnterpriseOne LATAM localizations: read access and partial denial of service","impact":"low","summary":"Oracle JD Edwards EnterpriseOne Localizations 9.2 (LATAM component) has a flaw reachable over the network through JDENET. A low-privileged user can read a subset of accessible data and partly disrupt the service.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone","erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads some accessible data and partly disrupts service","analyst_note":"","how_to_check":"- Confirm whether JD Edwards EnterpriseOne Localizations version `9.2` with the LATAM component is deployed.\n- unknown for further checks; the sources do not give specific configuration or file paths.","needs_analyst":false,"not_affected_if":["product-not-deployed","jdenet-not-reachable"],"who_is_affected":"Organizations running JD Edwards EnterpriseOne Localizations 9.2 with the LATAM component and JDENET network access enabled. Sites without this product or component, or without network exposure of JDENET to low-privileged users, are less exposed. The sources do not describe default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3524,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91292':16A,19A '/av':152C '3.1':140C,151C '5.4':143C '9.2':32B,82C 'abil':124C 'access':8A,54B,92C,111C,120C 'affect':80C 'allow':86C 'attack':89C,102C 'avail':146C 'base':141C 'caus':126C 'compon':34B,73C 'compromis':96C 'confidenti':144C 'cve':14A,17A 'cvss':139C,148C,150C 'data':55B,121C 'denial':11A,129C 'disrupt':58B 'dos':133C 'easili':83C 'edward':3A,24B,29B,65C,72C,98C,117C,136C 'enterpriseon':4A,20B,30B,66C,99C,118C,137C 'erp':21B 'exploit':84C 'flaw':37B 'impact':147C 'jd':2A,23B,28B,64C,71C,97C,116C,135C 'jd-edward':22B 'jdenet':43B,94C 'l':160C 'l/i':158C 'l/pr':154C 'l/ui':155C 'latam':5A,33B,74C 'local':6A,31B,67C,100C,119C,138C 'low':46B,87C 'low-privileg':45B 'n/a':159C 'n/ac':153C 'n/s':156C 'network':41B,91C 'oracl':1A,25B,27B,70C 'part':57B 'partial':10A,128C,132C 'privileg':47B,88C 'product':68C 'reachabl':38B 'read':7A,50B,110C 'result':107C 'score':142C 'servic':13A,60B,131C 'subset':52B,114C 'success':101C 'support':76C 'u/c':157C 'unauthor':109C,123C 'user':48B 'vector':149C 'vendor':26B 'version':77C 'via':93C 'vulner':61C,85C,105C","nicknames":[],"mitigations":[],"who_affected":"Organizations running JD Edwards EnterpriseOne Localizations 9.2 with the LATAM component and JDENET network access enabled. Sites without this product or component, or without network exposure of JDENET to low-privileged users, are less exposed. The sources do not describe default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91292","severity":null,"published_at":"2026-10-20T22:20:30+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}