{"id":"CVE-2026-91294","kind":"vulnerability","aliases":["CVE-2026-91294"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can partly crash service","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","summary":"A flaw in the Business Logic Infra SEC component of Oracle JD Edwards EnterpriseOne Tools lets a low-privileged user reach the service over JDENET and cause a partial denial of service. The sources report only availability impact, with no confidentiality or integrity loss.","severity":"medium","cvss":4.3,"epss":0.00262,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","oracle","other","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` to `9.2.26.5`\n- Confirm whether JDENET is reachable from networks outside the trusted server tier","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that moves past `9.2.26.5` (patch identifier unknown)","status":"open","published_at":"2026-10-20T22:20:30+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:39:03+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:39:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that moves past `9.2.26.5` (patch identifier unknown)","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can partly crash service","impact":"low","summary":"A flaw in the Business Logic Infra SEC component of Oracle JD Edwards EnterpriseOne Tools lets a low-privileged user reach the service over JDENET and cause a partial denial of service. The sources report only availability impact, with no confidentiality or integrity loss.","category":"other","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Partial denial of service of EnterpriseOne Tools; no data read or changed","analyst_note":"","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` to `9.2.26.5`\n- Confirm whether JDENET is reachable from networks outside the trusted server tier","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where a low-privileged account can reach JDENET over the network. Sites that keep JDENET restricted to internal server traffic and have no untrusted user accounts face much less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3504,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91294':17A,20A '/av':153C '3.1':143C,152C '4.3':146C '9.2.0.0':98C '9.2.26.5':99C 'abil':127C 'access':109C 'affect':96C 'allow':103C 'attack':106C,119C 'avail':67B,147C 'base':144C 'busi':34B,88C 'caus':57B,129C 'compon':38B,87C 'compromis':113C 'confidenti':71B 'crash':13A 'cve':15A,18A 'cvss':142C,149C,151C 'denial':60B,132C 'dos':136C 'easili':100C 'edward':3A,24B,42B,79C,86C,115C,139C 'enterpriseon':4A,21B,43B,80C,116C,140C 'exploit':101C 'flaw':31B 'host':29B 'impact':68B,148C 'infra':36B,90C 'integr':73B 'jd':2A,23B,41B,78C,85C,114C,138C 'jd-edward':22B 'jdenet':55B,111C 'l':161C 'l/pr':155C 'l/ui':156C 'let':45B 'logic':35B,89C 'loss':74B 'low':7A,48B,104C 'low-privileg':6A,47B 'n/a':160C 'n/ac':154C 'n/i':159C 'n/s':157C 'network':9A,108C 'oracl':1A,25B,40B,84C 'part':12A 'partial':59B,131C,135C 'privileg':8A,49B,105C 'product':82C 'reach':51B 'report':65B 'result':124C 'score':145C 'sec':37B,91C 'self':28B 'self-host':27B 'servic':14A,53B,62B,134C 'sourc':64B 'success':118C 'support':92C 'tool':5A,44B,81C,117C,141C 'u/c':158C 'unauthor':126C 'user':10A,50B 'vector':150C 'version':93C 'via':110C 'vulner':75C,102C,122C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where a low-privileged account can reach JDENET over the network. Sites that keep JDENET restricted to internal server traffic and have no untrusted user accounts face much less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91294","severity":null,"published_at":"2026-10-20T22:20:30+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91294","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91294","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}