---
id: "CVE-2026-91299"
kind: "vulnerability"
aliases: ["CVE-2026-91299"]
title: "Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flaw"
severity: "critical"
cvss: 10.0
epss: 0.00363
exploited: false
status: "open"
category: "other"
products: [{"name": "JD Edwards EnterpriseOne Orchestrator", "fixed": [], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterpriseone", "jd-edwards", "oracle", "other", "self-hosted"]
not_affected_if: ["default-config", "not-network-reachable", "orchestrator-not-deployed"]
published_at: "2026-10-20T22:20:31+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91299", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:58:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91299", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flaw

The E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator, versions 9.2.0.0 through 9.2.26.5, has a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation gives the attacker full takeover of the Orchestrator, with impact that can spread to other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Orchestrator affected >= 9.2.0.0, <= 9.2.26.5 fixed ?

## How to check

Check your JD Edwards EnterpriseOne Tools/Orchestrator release. Affected if it is 9.2.0.0 through 9.2.26.5 and the Orchestrator (E1 IOT Orchestrator) HTTP port is reachable. Run the Orchestrator version check from your admin console.

## Fix

Apply the Oracle October 2026 Critical Patch Update for JD Edwards EnterpriseOne Orchestrator from My Oracle Support. The exact fixed build is unknown; it is above 9.2.26.5. Until patched, restrict network access to the Orchestrator HTTP port to trusted hosts.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91299
- 2026-10-23T22:58:30+00:00 analyst — Oracle CPU Oct 2026 (released 2026-10-20) and CVE.org confirm affected 9.2.0.0-9.2.26.5 inclusive, CVSS 10.0. Oracle's public page gives no fixed build number; Armis says fixed is above 9.2.26.5 via CPU Oct 2026 patch on My Oracle Support. No exploitation or PoC found in sources; X and Bluesky not searched. NVD page returned empty.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91299

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] CVE Record: CVE-2026-91299 https://www.cve.org/CVERecord?id=CVE-2026-91299
- [mitigation] Armis: CVE-2026-91299 https://cve.armis.com/CVE-2026-91299

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_