---
id: "CVE-2026-91296"
kind: "vulnerability"
aliases: ["CVE-2026-91296"]
title: "Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP takeover after one user click"
severity: "high"
cvss: 8.8
epss: 0.00392
exploited: false
status: "resolved"
category: "package"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": ["9.2.26.6"], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterpriseone", "jd-edwards", "oracle", "package", "self-hosted"]
not_affected_if: ["versions-outside-9.2.0.0-9.2.26.5"]
published_at: "2026-10-20T22:20:31+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91296", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:56:11+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91296", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP takeover after one user click

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Enterprise Infrastructure SEC component. A remote, unauthenticated attacker can take over the product over HTTP if another person interacts with a crafted request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed 9.2.26.6

## How to check

Find your JD Edwards EnterpriseOne Tools release (Server Manager console or the release shown at sign-on/About). Exposed if it is 9.2.0.0 through 9.2.26.5 and the JDE HTTP web tier/AIS is reachable by users who could be lured into a crafted request.

## Fix

Apply the Oracle October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support; Armis reports fixed in Tools 9.2.26.6 or later (not confirmed on Oracle's page). Interim, per Armis: restrict network access to the JDE web tier to trusted internal networks; this reduces but does not remove exposure.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91296
- 2026-10-23T23:56:11+00:00 analyst — Oracle Oct 2026 CPU confirms Tools 9.2.0.0-9.2.26.5 affected (JDE risk matrix section truncated, unread). Fixed 9.2.26.6 from Armis only, unconfirmed by Oracle. No exploitation/PoC seen; did not search social.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91296

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Armis: CVE-2026-91296 (fixed 9.2.26.6) https://cve.armis.com/CVE-2026-91296

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_