Live › vulnerability › CVE-2026-91299
Go to dashboardThe E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0 through 9.2.26.5, has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation gives the attacker full takeover of the Orchestrator, with impact that can spread to other products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| JD Edwards EnterpriseOne Orchestrator | vendor | >= 9.2.0.0, <= 9.2.26.5 | – |
9.2.0.0 through 9.2.26.5 and the Orchestrator (E1 IOT Orchestrator) HTTP port is reachable9.2.26.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91299")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.