{"id":"CVE-2026-91326","kind":"vulnerability","aliases":["CVE-2026-91326"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: adjacent attacker takes over installs","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.4 have an Installation Security flaw. An attacker on the physical network segment of the host, with a user taking one action, can take over the EnterpriseOne Tools installation and affect other products.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":[],"affected":">= 9.2.0.0, <= 9.2.26.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","enterpriseone","jd-edwards","oracle","other","package","self-hosted"],"not_affected_if":["no-untrusted-hosts-on-same-segment","outside-9.2.0.0-9.2.26.4"],"how_to_check":"Check your EnterpriseOne Tools release (Server Manager or Tools release level shown at JDE sign-on/Software Versions). Versions 9.2.0.0 through 9.2.26.4 are named in the CVE; the CPU table also lists 9.2.26.5, so treat 9.2.26.5 as unconfirmed too. Also check whether untrusted hosts share the network segment/VLAN with the Tools install host.","fix":"Apply the October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support (patch availability document 'JD Edwards'); exact fixed Tools build not published publicly, unknown until read in MOS. Until then, restrict the Tools/deployment server's network segment to trusted hosts and avoid running install or deployment actions from untrusted sources.","status":"open","published_at":"2026-10-20T22:20:34+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:07+00:00","updated_at":"2026-10-23T23:56:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T22:34:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: adjacent attacker takes over installs","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.4 have an Installation Security flaw. An attacker on the physical network segment of the host, with a user taking one action, can take over the EnterpriseOne Tools installation and affect other products.","category":"other","who_cares":["enterpriseone","jd-edwards","oracle","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker on adjacent network takes over the EnterpriseOne Tools host","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["outside-9.2.0.0-9.2.26.4"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000968,"input_tokens":3191,"output_tokens":1297,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the vulnerable install-time component and the patch level in Oracle's Critical Patch Update advisory; the NVD record gives no fix version or check.","search":"'-2026':12A,15A '-91326':13A,16A '/av':186C '3.1':173C,185C '8.8':176C '9.2.0.0':40B,96C '9.2.26.4':42B,97C 'a/ac':187C 'access':105C 'action':63B 'addit':154C 'adjac':6A,22B 'adjacent-network':21B 'affect':72B,94C 'allow':101C 'attach':111C 'attack':7A,49B,103C,129C,139C,150C,159C 'avail':180C 'base':174C 'c/c':191C 'chang':157C 'communic':109C 'compon':87C 'compromis':123C 'confidenti':177C 'cve':11A,14A 'cvss':172C,182C,184C 'easili':98C 'edward':3A,27B,36B,79C,86C,118C,125C,147C,169C 'edwards':18A 'enterpriseon':4A,24B,37B,68B,80C,119C,126C,148C,170C 'enterpriseone':19A 'execut':121C 'exploit':99C 'flaw':47B 'h':194C 'h/a':193C 'h/i':192C 'hardwar':114C 'host':33B,57B 'human':131C 'impact':153C,181C 'instal':10A,45B,70B,88C 'integr':178C 'interact':132C 'jd':2A,17A,26B,35B,78C,85C,117C,124C,146C,168C 'jd-edward':25B 'l/pr':188C 'may':151C 'n/ui':189C 'network':23B,53B 'one':62B 'oracl':1A,28B,34B,84C 'packag':30B 'person':135C 'physic':52B,108C 'product':74B,82C,155C 'r/s':190C 'requir':130C 'result':164C 'scope':156C 'score':175C 'secur':46B,89C 'segment':54B,110C 'self':32B 'self-host':31B 'signific':152C 'success':128C,158C 'support':90C 'take':8A,61B,65B 'takeov':166C 'tool':5A,38B,69B,81C,120C,127C,149C,171C 'tools':20A 'unauthent':102C 'user':60B 'vector':183C 'version':39B,91C 'vulner':75C,100C,143C,162C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91326","severity":null,"published_at":"2026-10-20T22:20:34+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91326:550","url":null,"severity":null,"published_at":"2026-10-23T23:56:07+00:00","modified_at":"2026-10-23T23:56:07+00:00","first_seen_at":"2026-10-23T23:56:07+00:00","fetched_at":"2026-10-23T23:56:07+00:00","note":"Oracle CPU Oct 2026 lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 in its table (CVE text says through 9.2.26.4); no per-CVE fix build on the public page, patch details are behind My Oracle Support. Armis claims fix is 'above 9.2.26.4' but that conflicts with the CPU table, so fix left unconfirmed. Not exploited per sources, no PoC found; X not searched (low conversation expected)."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2259,"url":"https://cve.armis.com/CVE-2026-91326","title":"Armis: CVE-2026-91326","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}