{"id":"CVE-2026-91310","kind":"vulnerability","aliases":["CVE-2026-91310"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privileged network user can take over","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Installation SEC component. A low-privileged attacker with network access over JDENET can fully compromise the product.","severity":"high","cvss":8.8,"epss":0.00328,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":["9.2.26.6"],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["enterprise-erp","enterpriseone","jd-edwards","jdenet","oracle","self-hosted","vendor"],"not_affected_if":["jdenet-not-network-reachable","versions-outside-9.2.0.0-9.2.26.5"],"how_to_check":"Check your EnterpriseOne Tools release (Server Manager or the Tools release shown at sign-on). Versions 9.2.0.0 through 9.2.26.5 are affected. Also check whether the JDENET port (default TCP 6009) is reachable from untrusted networks.","fix":"Apply the October 2026 CPU Tools patch from My Oracle Support: move to 9.2.26.6 or later (per Armis; unconfirmed on Oracle's page). Until then, restrict JDENET (default TCP 6009) to trusted hosts with firewall ACLs.","status":"open","published_at":"2026-10-20T22:20:32+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:05+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.65,"triage":{"at":"2026-10-23T22:34:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privileged network user can take over","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Installation SEC component. A low-privileged attacker with network access over JDENET can fully compromise the product.","category":"vendor","who_cares":["jd-edwards","enterpriseone","oracle","enterprise-erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over EnterpriseOne Tools, reading and changing data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched 9.2 release and the exact JDENET exposure details at https://nvd.nist.gov/vuln/detail/CVE-2026-91310.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-9.2.0.0-9.2.26.5"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000513,"input_tokens":3106,"output_tokens":404,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched 9.2 release and the exact JDENET exposure details at https://nvd.nist.gov/vuln/detail/CVE-2026-91310.","search":"'-2026':14A,17A '-91310':15A,18A '/av':137C '3.1':124C,136C '8.8':127C '9.2.0.0':42B,89C '9.2.26.5':44B,90C 'access':60B,100C 'affect':87C 'allow':94C 'attack':57B,97C,110C 'avail':131C 'base':125C 'compon':52B,80C 'compromis':65B,104C 'confidenti':128C 'cve':13A,16A 'cvss':123C,133C,135C 'easili':91C 'edward':3A,29B,38B,72C,79C,106C,120C 'edwards':20A 'enterpris':24B 'enterprise-erp':23B 'enterpriseon':4A,26B,39B,73C,107C,121C 'enterpriseone':21A 'erp':25B 'exploit':92C 'flaw':47B 'fulli':64B 'h':145C 'h/a':144C 'h/i':143C 'host':34B 'impact':132C 'instal':50B,81C 'integr':129C 'jd':2A,19A,28B,37B,71C,78C,105C,119C 'jd-edward':27B 'jdenet':30B,62B,102C 'l/pr':139C 'l/ui':140C 'low':7A,55B,95C 'low-privileg':6A,54B 'n/ac':138C 'n/s':141C 'network':9A,59B,99C 'oracl':1A,31B,36B,77C 'privileg':8A,56B,96C 'product':67B,75C 'result':115C 'score':126C 'sec':51B,82C 'self':33B 'self-host':32B 'success':109C 'support':83C 'take':12A 'takeov':117C 'tool':5A,40B,74C,108C,122C 'tools':22A 'u/c':142C 'user':10A 'vector':134C 'vendor':35B 'version':41B,84C 'via':101C 'vulner':68C,93C,113C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91310","severity":null,"published_at":"2026-10-20T22:20:32+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91310:551","url":null,"severity":null,"published_at":"2026-10-23T23:56:11+00:00","modified_at":"2026-10-23T23:56:11+00:00","first_seen_at":"2026-10-23T23:56:11+00:00","fetched_at":"2026-10-23T23:56:11+00:00","note":"Oracle Oct 2026 CPU lists it (CVSS 8.8, Oracle-scored). I could not read the JD Edwards matrix row on Oracle's own page (verbose page truncated), so fixed version 9.2.26.6 and the port 6009 mitigation come from Armis only; confirm on the CPU advisory/MOS. No exploitation or PoC found; no X search done."},{"source":"epss","external_id":"CVE-2026-91310","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91310","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2262,"url":"https://cve.armis.com/CVE-2026-91310","title":"Armis: CVE-2026-91310 (fix 9.2.26.6, JDENET port 6009 mitigation)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}