{"id":"CVE-2026-91306","kind":"vulnerability","aliases":["CVE-2026-91306"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: local low-privilege takeover via installation security","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in their Installation Security component. A low-privileged user with logon to the host where the tools run can take over the EnterpriseOne Tools installation.","severity":"high","cvss":7.8,"epss":0.00118,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","package","self-hosted"],"not_affected_if":["no-local-logon","outside-version-range"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is in the range `9.2.0.0` to `9.2.26.5` using the vendor's version tooling\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE-2026-91306 fix","fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that addresses CVE-2026-91306, moving past `9.2.26.5`\n- Restrict OS logon on hosts running EnterpriseOne Tools to trusted accounts until patched","status":"open","published_at":"2026-10-20T22:20:32+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:08:48+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:08:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that addresses CVE-2026-91306, moving past `9.2.26.5`\n- Restrict OS logon on hosts running EnterpriseOne Tools to trusted accounts until patched","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: local low-privilege takeover via installation security","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in their Installation Security component. A low-privileged user with logon to the host where the tools run can take over the EnterpriseOne Tools installation.","category":"package","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","self-hosted","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"low-privilege local user takes over EnterpriseOne Tools installation","analyst_note":"Confirm the patched release and Oracle CPU advisory for CVE-2026-91306; the NVD entry gives no fixed version or check command.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is in the range `9.2.0.0` to `9.2.26.5` using the vendor's version tooling\n- Check the Oracle Critical Patch Update advisory for the patch level that covers this CVE-2026-91306 fix","needs_analyst":true,"not_affected_if":["outside-version-range","no-local-logon"],"who_is_affected":"Teams running Oracle JD Edwards EnterpriseOne Tools 9.2 releases up to 9.2.26.5 on servers where people or services can log on. The attacker needs a local account on the infrastructure that runs the tools, so systems with no interactive or service logons to that host carry less exposure. Installations on newer releases outside the stated range can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":3504,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91306':16A,19A '/av':145C '3.1':132C,144C '7.8':135C '9.2.0.0':38B,91C '9.2.26.5':40B,92C 'affect':89C 'allow':96C 'attack':99C,118C 'avail':139C 'base':133C 'compon':48B,82C 'compromis':112C 'confidenti':136C 'cve':14A,17A 'cvss':131C,141C,143C 'easili':93C 'edward':3A,23B,34B,74C,81C,107C,114C,128C 'enterpriseon':4A,20B,35B,67B,75C,108C,115C,129C 'execut':110C 'exploit':94C 'flaw':43B 'h':153C 'h/a':152C 'h/i':151C 'host':31B,58B 'impact':140C 'infrastructur':104C 'instal':12A,46B,69B,83C 'integr':137C 'jd':2A,22B,33B,73C,80C,106C,113C,127C 'jd-edward':21B 'l/ac':146C 'l/pr':147C 'l/ui':148C 'local':6A 'logon':55B,101C 'low':8A,51B,97C 'low-privileg':7A,50B 'n/s':149C 'on-prem':24B 'oracl':1A,27B,32B,79C 'packag':28B 'prem':26B 'privileg':9A,52B,98C 'product':77C 'result':123C 'run':62B 'score':134C 'secur':13A,47B,84C 'self':30B 'self-host':29B 'success':117C 'support':85C 'take':64B 'takeov':10A,125C 'tool':5A,36B,61B,68B,76C,109C,116C,130C 'u/c':150C 'user':53B 'vector':142C 'version':37B,86C 'via':11A 'vulner':70C,95C,121C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle JD Edwards EnterpriseOne Tools 9.2 releases up to 9.2.26.5 on servers where people or services can log on. The attacker needs a local account on the infrastructure that runs the tools, so systems with no interactive or service logons to that host carry less exposure. Installations on newer releases outside the stated range can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91306","severity":null,"published_at":"2026-10-20T22:20:32+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91306","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91306","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}