Live › vulnerability › CVE-2026-91327
Go to dashboardOracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. An unauthenticated attacker on the physical network segment attached to the host can take over the product, per the sources' description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 are affected. The sources describe the attacker as needing access to the physical communication segment attached to the hardware running the tools, which makes this a network-adjacency issue rather than an internet-facing one. Teams whose tools hosts are on isolated segments with no untrusted access face lower practical risk.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91327")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.