Live › vulnerability › CVE-2026-91293
Go to dashboardA flaw in the Business Logic Infra SEC component of Oracle JD Edwards EnterpriseOne Tools lets a low-privileged user reach the server over JDENET. An attacker can read a subset of accessible data and cause a partial denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
JD Edwards EnterpriseOne Tools installations on the 9.2.0.0 to 9.2.26.5 release range are affected. The attack path is network access via JDENET with a low-privileged account, so systems where JDENET is reachable from untrusted networks deserve the most attention. The sources do not say which deployments can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-91293")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.