---
id: "CVE-2026-91295"
kind: "vulnerability"
aliases: ["CVE-2026-91295"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over"
severity: "high"
cvss: 8.8
epss: 0.00447
exploited: false
status: "open"
category: "vendor"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": ["9.2.26.6 (unconfirmed, per Armis)"], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterprise-erp", "enterpriseone", "infrastructure", "jd-edwards", "oracle", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-20T22:20:31+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91295", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:57:19+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91295", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take over

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Enterprise Infrastructure SEC component. An attacker with a low-privilege account and network access over HTTP can take over the product, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed 9.2.26.6 (unconfirmed, per Armis)

## How to check

Check your installed EnterpriseOne Tools release (Tools release level shown in the Server Manager / Web Development Client). Exposed if it is 9.2.0.0 through 9.2.26.5 and the HTTP server is reachable by any authenticated low-privilege user.

## Fix

Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support (JD Edwards patch availability document). Armis reports 9.2.26.6 or later as the fixed level; Oracle's advisory does not state it, so confirm in the MOS note. Until patched, restrict HTTP access to the JDE application server to trusted segments and audit low-privilege accounts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91295
- 2026-10-23T23:57:19+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 but gives no fixed version; Armis says 9.2.26.6+ (secondary, inferred from range end). Patch via My Oracle Support. No exploitation or PoC seen; social search not run.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91295

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91295 https://www.cve.org/CVERecord?id=CVE-2026-91295
- [fix] CVE-2026-91295 | Armis https://cve.armis.com/CVE-2026-91295

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_