{"id":"CVE-2026-91296","kind":"vulnerability","aliases":["CVE-2026-91296"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP takeover after one user click","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Enterprise Infrastructure SEC component. A remote, unauthenticated attacker can take over the product over HTTP if another person interacts with a crafted request.","severity":"high","cvss":8.8,"epss":0.00392,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":["9.2.26.6"],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterpriseone","jd-edwards","oracle","package","self-hosted"],"not_affected_if":["versions-outside-9.2.0.0-9.2.26.5"],"how_to_check":"Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the release shown at sign-on/About). Exposed if it is 9.2.0.0 through 9.2.26.5 and the JDE HTTP web tier/AIS is reachable by users who could be lured into a crafted request.","fix":"Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support; Armis reports fixed in Tools 9.2.26.6 or later (not confirmed on Oracle's page). Interim, per Armis: restrict network access to the JDE web tier to trusted internal networks; this reduces but does not remove exposure.","status":"resolved","published_at":"2026-10-20T22:20:31+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:09+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:34:09Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Enterprise Infrastructure SEC component; move past 9.2.26.5. Exact patch name unknown from sources.","reach":"internet","title":"Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP takeover after one user click","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Enterprise Infrastructure SEC component. A remote, unauthenticated attacker can take over the product over HTTP if another person interacts with a crafted request.","category":"package","who_cares":["jd-edwards","enterpriseone","oracle"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the EnterpriseOne Tools server, with full read, write and availability impact.","analyst_note":"Find the Oracle Critical Patch Update advisory listing the fixed build and any detection steps for Enterprise Infrastructure SEC; the NVD entry does not give a fixed version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-9.2.0.0-9.2.26.5"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00056,"input_tokens":3132,"output_tokens":493,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory listing the fixed build and any detection steps for Enterprise Infrastructure SEC; the NVD entry does not give a fixed version.","search":"'-2026':14A,17A '-91296':15A,18A '/av':149C '3.1':136C,148C '8.8':139C '9.2.0.0':37B,90C '9.2.26.5':39B,91C 'access':100C 'affect':88C 'allow':95C 'anoth':61B 'attack':52B,97C,110C,120C,122C 'avail':143C 'base':137C 'click':12A 'compon':48B,80C 'compromis':104C 'confidenti':140C 'craft':66B 'cve':13A,16A 'cvss':135C,145C,147C 'easili':92C 'edward':3A,26B,34B,72C,79C,106C,132C 'edwards':20A 'enterpris':45B,81C 'enterpriseon':4A,23B,35B,73C,107C,133C 'enterpriseone':21A 'exploit':93C 'flaw':42B 'h':157C 'h/a':156C 'h/i':155C 'host':31B 'http':7A,59B,102C 'human':112C 'impact':144C 'infrastructur':46B,82C 'integr':141C 'interact':63B,113C 'jd':2A,19A,25B,33B,71C,78C,105C,131C 'jd-edward':24B 'l/pr':151C 'n/ac':150C 'n/ui':152C 'network':99C 'one':10A 'oracl':1A,27B,32B,77C 'packag':28B 'person':62B,116C 'product':57B,75C 'r/s':153C 'remot':50B 'request':67B 'requir':111C 'result':127C 'score':138C 'sec':47B,83C 'self':30B 'self-host':29B 'success':109C,121C 'support':84C 'take':54B 'takeov':8A,129C 'tool':5A,36B,74C,108C,134C 'tools':22A 'u/c':154C 'unauthent':6A,51B,96C 'user':11A 'vector':146C 'version':85C 'via':101C 'vulner':68C,94C,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91296","severity":null,"published_at":"2026-10-20T22:20:31+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91296:552","url":null,"severity":null,"published_at":"2026-10-23T23:56:11+00:00","modified_at":"2026-10-23T23:56:11+00:00","first_seen_at":"2026-10-23T23:56:11+00:00","fetched_at":"2026-10-23T23:56:11+00:00","note":"Oracle Oct 2026 CPU confirms Tools 9.2.0.0-9.2.26.5 affected (JDE risk matrix section truncated, unread). Fixed 9.2.26.6 from Armis only, unconfirmed by Oracle. No exploitation/PoC seen; did not search social."},{"source":"epss","external_id":"CVE-2026-91296","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91296","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2264,"url":"https://cve.armis.com/CVE-2026-91296","title":"Armis: CVE-2026-91296 (fixed 9.2.26.6)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}