---
id: "CVE-2026-91326"
kind: "vulnerability"
aliases: ["CVE-2026-91326"]
title: "Oracle JD Edwards EnterpriseOne Tools: adjacent attacker takes over installs"
severity: "high"
cvss: 8.8
epss: 0.0023
exploited: false
status: "open"
category: "other"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": [], "affected": ">= 9.2.0.0, <= 9.2.26.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent-network", "enterpriseone", "jd-edwards", "oracle", "other", "package", "self-hosted"]
not_affected_if: ["no-untrusted-hosts-on-same-segment", "outside-9.2.0.0-9.2.26.4"]
published_at: "2026-10-20T22:20:34+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91326", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:56:07+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91326", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: adjacent attacker takes over installs

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.4 have an Installation Security flaw. An attacker on the physical network segment of the host, with a user taking one action, can take over the EnterpriseOne Tools installation and affect other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.4 fixed ?

## How to check

Check your EnterpriseOne Tools release (Server Manager or Tools release level shown at JDE sign-on/Software Versions). Versions 9.2.0.0 through 9.2.26.4 are named in the CVE; the CPU table also lists 9.2.26.5, so treat 9.2.26.5 as unconfirmed too. Also check whether untrusted hosts share the network segment/VLAN with the Tools install host.

## Fix

Apply the October 2026 CPU patch for JD Edwards EnterpriseOne Tools from My Oracle Support (patch availability document 'JD Edwards'); exact fixed Tools build not published publicly, unknown until read in MOS. Until then, restrict the Tools/deployment server's network segment to trusted hosts and avoid running install or deployment actions from untrusted sources.

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91326
- 2026-10-23T23:56:07+00:00 analyst — Oracle CPU Oct 2026 lists JDE EnterpriseOne Tools 9.2.0.0-9.2.26.5 in its table (CVE text says through 9.2.26.4); no per-CVE fix build on the public page, patch details are behind My Oracle Support. Armis claims fix is 'above 9.2.26.4' but that conflicts with the CPU table, so fix left unconfirmed. Not exploited per sources, no PoC found; X not searched (low conversation expected).
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91326

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] Armis: CVE-2026-91326 https://cve.armis.com/CVE-2026-91326

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_