---
id: "CVE-2026-91310"
kind: "vulnerability"
aliases: ["CVE-2026-91310"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privileged network user can take over"
severity: "high"
cvss: 8.8
epss: 0.00328
exploited: false
status: "open"
category: "vendor"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": ["9.2.26.6"], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["enterprise-erp", "enterpriseone", "jd-edwards", "jdenet", "oracle", "self-hosted", "vendor"]
not_affected_if: ["jdenet-not-network-reachable", "versions-outside-9.2.0.0-9.2.26.5"]
published_at: "2026-10-20T22:20:32+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91310", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:56:11+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91310", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privileged network user can take over

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Installation SEC component. A low-privileged attacker with network access over JDENET can fully compromise the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed 9.2.26.6

## How to check

Check your EnterpriseOne Tools release (Server Manager or the Tools release shown at sign-on). Versions 9.2.0.0 through 9.2.26.5 are affected. Also check whether the JDENET port (default TCP 6009) is reachable from untrusted networks.

## Fix

Apply the October 2026 CPU Tools patch from My Oracle Support: move to 9.2.26.6 or later (per Armis; unconfirmed on Oracle's page). Until then, restrict JDENET (default TCP 6009) to trusted hosts with firewall ACLs.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91310
- 2026-10-23T23:56:11+00:00 analyst — Oracle Oct 2026 CPU lists it (CVSS 8.8, Oracle-scored). I could not read the JD Edwards matrix row on Oracle's own page (verbose page truncated), so fixed version 9.2.26.6 and the port 6009 mitigation come from Armis only; confirm on the CPU advisory/MOS. No exploitation or PoC found; no X search done.
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91310

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Armis: CVE-2026-91310 (fix 9.2.26.6, JDENET port 6009 mitigation) https://cve.armis.com/CVE-2026-91310

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_