{"id":"CVE-2026-91299","kind":"vulnerability","aliases":["CVE-2026-91299"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flaw","description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","summary":"The E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0 through 9.2.26.5, has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation gives the attacker full takeover of the Orchestrator, with impact that can spread to other products.","severity":"critical","cvss":10.0,"epss":0.00363,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Orchestrator","fixed":[],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterpriseone","jd-edwards","oracle","other","self-hosted"],"not_affected_if":["default-config","not-network-reachable","orchestrator-not-deployed"],"how_to_check":"Check your JD Edwards EnterpriseOne Tools/Orchestrator release. Affected if it is 9.2.0.0 through 9.2.26.5 and the Orchestrator (E1 IOT Orchestrator) HTTP port is reachable. Run the Orchestrator version check from your admin console.","fix":"Apply the Oracle October 2026 Critical Patch Update for JD Edwards EnterpriseOne Orchestrator from My Oracle Support. The exact fixed build is unknown; it is above 9.2.26.5. Until patched, restrict network access to the Orchestrator HTTP port to trusted hosts.","status":"open","published_at":"2026-10-20T22:20:31+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:08+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:34:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flaw","impact":"high","summary":"The E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0 through 9.2.26.5, has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation gives the attacker full takeover of the Orchestrator, with impact that can spread to other products.","category":"other","who_cares":["enterpriseone","jd-edwards","oracle","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the Orchestrator and affects connected products","analyst_note":"Find the Oracle Critical Patch Update advisory for the fixed build and confirm whether 9.2.26.5 is the last affected version; check the NVD page linked in sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000525,"input_tokens":3173,"output_tokens":415,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for the fixed build and confirm whether 9.2.26.5 is the last affected version; check the NVD page linked in sources.","search":"'-2026':11A,14A '-91299':12A,15A '/av':161C '10.0':151C '3.1':148C,160C '9.2.0.0':42B,97C '9.2.26.5':44B,98C 'access':107C 'addit':129C 'affect':95C 'allow':102C 'attack':51B,60B,104C,125C,134C 'avail':155C 'base':149C 'c/c':166C 'chang':132C 'compon':34B,86C 'compromis':111C 'confidenti':152C 'cve':10A,13A 'cvss':147C,157C,159C 'e1':30B,87C 'easili':99C 'edward':3A,23B,38B,78C,85C,113C,122C,144C 'edwards':17A 'enterpriseon':4A,20B,39B,79C,114C,123C,145C 'enterpriseone':18A 'exploit':57B,100C 'flaw':9A,47B 'full':61B 'give':58B 'h':169C 'h/a':168C 'h/i':167C 'host':28B 'http':55B,109C 'impact':67B,128C,156C 'integr':153C 'iot':31B,88C 'jd':2A,16A,22B,37B,77C,84C,112C,121C,143C 'jd-edward':21B 'l/pr':163C 'may':126C 'n/ac':162C 'n/s':165C 'n/ui':164C 'network':7A,106C 'oracl':1A,24B,36B,83C 'orchestr':5A,32B,40B,65B,80C,89C,115C,124C,146C 'orchestrator':19A 'product':73B,81C,130C 'reach':53B 'result':139C 'scope':131C 'score':150C 'secur':33B,90C 'self':27B 'self-host':26B 'signific':127C 'spread':70B 'success':56B,133C 'support':91C 'takeov':8A,62B,141C 'unauthent':6A,50B,103C 'vector':158C 'version':41B,92C 'via':108C 'vulner':74C,101C,118C,137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91299","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91299","severity":null,"published_at":"2026-10-20T22:20:31+00:00","modified_at":"2026-10-23T12:18:17+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91299:338","url":null,"severity":null,"published_at":"2026-10-23T22:58:30+00:00","modified_at":"2026-10-23T22:58:30+00:00","first_seen_at":"2026-10-23T22:58:30+00:00","fetched_at":"2026-10-23T22:58:30+00:00","note":"Oracle CPU Oct 2026 (released 2026-10-20) and CVE.org confirm affected 9.2.0.0-9.2.26.5 inclusive, CVSS 10.0. Oracle's public page gives no fixed build number; Armis says fixed is above 9.2.26.5 via CPU Oct 2026 patch on My Oracle Support. No exploitation or PoC found in sources; X and Bluesky not searched. NVD page returned empty."},{"source":"epss","external_id":"CVE-2026-91299","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91299","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1704,"url":"https://cve.armis.com/CVE-2026-91299","title":"Armis: CVE-2026-91299","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1706,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91299","title":"CVE Record: CVE-2026-91299","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}