{"id":"CVE-2026-91304","kind":"vulnerability","aliases":["CVE-2026-91304"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: installation security flaw allows takeover","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. A local attacker who can log on to the host where the tools run can take over the product, provided a person other than the attacker takes an action.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["outside-affected-versions"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` to `9.2.26.5`\n- Review the Oracle Critical Patch Update advisory for the exact patched release unknown","fix":"- Move EnterpriseOne Tools to a release newer than `9.2.26.5` as listed in the Oracle Critical Patch Update advisory\n- Restrict local logon to the hosts that run EnterpriseOne Tools","status":"open","published_at":"2026-10-20T22:20:32+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:08:48+00:00","updated_at":"2026-10-25T03:08:48+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:08:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move EnterpriseOne Tools to a release newer than `9.2.26.5` as listed in the Oracle Critical Patch Update advisory\n- Restrict local logon to the hosts that run EnterpriseOne Tools","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: installation security flaw allows takeover","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. A local attacker who can log on to the host where the tools run can take over the product, provided a person other than the attacker takes an action.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over EnterpriseOne Tools, reading and changing its data","analyst_note":"Find the patched release and the exact Installation Security fix in the Oracle Critical Patch Update advisory for this CVE.","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` to `9.2.26.5`\n- Review the Oracle Critical Patch Update advisory for the exact patched release unknown","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Teams that run Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range. The attacker needs a logon on the infrastructure where the tools execute, so the risk sits with shared or poorly isolated hosts. Teams on other releases or without JD Edwards can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3527,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-91304':13A,16A '/av':155C '3.1':142C,154C '7.8':145C '9.2.0.0':32B,90C '9.2.26.5':34B,91C 'action':68B 'affect':88C 'allow':9A,95C 'attack':42B,65B,97C,116C,126C,128C 'avail':149C 'base':143C 'compon':81C 'compromis':110C 'confidenti':146C 'cve':11A,14A 'cvss':141C,151C,153C 'easili':92C 'edward':3A,20B,28B,73C,80C,105C,112C,138C 'enterpriseon':4A,17B,29B,74C,106C,113C,139C 'execut':108C 'exploit':93C 'flaw':8A,39B 'h':163C 'h/a':162C 'h/i':161C 'host':49B 'human':118C 'impact':150C 'infrastructur':102C 'instal':6A,37B,82C 'integr':147C 'interact':119C 'jd':2A,19B,27B,72C,79C,104C,111C,137C 'jd-edward':18B 'l/ac':156C 'l/pr':157C 'local':41B 'log':45B 'logon':99C 'n/ui':158C 'on-prem':21B 'oracl':1A,24B,26B,78C 'person':61B,122C 'prem':23B 'product':58B,76C 'provid':59B 'r/s':159C 'requir':117C 'result':133C 'run':53B 'score':144C 'secur':7A,38B,83C 'success':115C,127C 'support':84C 'take':55B,66B 'takeov':10A,135C 'tool':5A,30B,52B,75C,107C,114C,140C 'u/c':160C 'unauthent':96C 'vector':152C 'vendor':25B 'version':31B,85C 'vulner':69C,94C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range. The attacker needs a logon on the infrastructure where the tools execute, so the risk sits with shared or poorly isolated hosts. Teams on other releases or without JD Edwards can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91304","severity":null,"published_at":"2026-10-20T22:20:32+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}