{"id":"CVE-2026-91327","kind":"vulnerability","aliases":["CVE-2026-91327"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: installation flaw allows takeover from adjacent network","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. An unauthenticated attacker on the physical network segment attached to the host can take over the product, per the sources' description.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","package"],"not_affected_if":["isolated-network-segment","versions-outside-9.2.0.0-9.2.26.5"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 to 9.2.26.5 (version check method unknown from sources)\n- Check whether the host sits on a segment reachable by untrusted parties (unknown from sources)","fix":"- Move EnterpriseOne Tools to a release later than 9.2.26.5 per Oracle's advisory (exact fixed version unknown from sources)\n- Apply Oracle's Critical Patch Update for the affected release (patch identifier unknown from sources)","status":"open","published_at":"2026-10-20T22:20:34+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:18:30+00:00","updated_at":"2026-10-25T03:18:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:18:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move EnterpriseOne Tools to a release later than 9.2.26.5 per Oracle's advisory (exact fixed version unknown from sources)\n- Apply Oracle's Critical Patch Update for the affected release (patch identifier unknown from sources)","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: installation flaw allows takeover from adjacent network","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. An unauthenticated attacker on the physical network segment attached to the host can take over the product, per the sources' description.","category":"package","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the EnterpriseOne Tools host","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed release and any installation-time workaround; sources give only the CVSS vector and affected range.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 to 9.2.26.5 (version check method unknown from sources)\n- Check whether the host sits on a segment reachable by untrusted parties (unknown from sources)","needs_analyst":true,"not_affected_if":["versions-outside-9.2.0.0-9.2.26.5","isolated-network-segment"],"who_is_affected":"Sites running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 are affected. The sources describe the attacker as needing access to the physical communication segment attached to the hardware running the tools, which makes this a network-adjacency issue rather than an internet-facing one. Teams whose tools hosts are on isolated segments with no untrusted access face lower practical risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":3515,"output_tokens":713,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91327':15A,18A '/av':145C '3.1':132C,144C '7.5':135C '9.2.0.0':34B,84C '9.2.26.5':36B,85C 'a/ac':146C 'access':94C 'adjac':11A 'affect':82C 'allow':8A,90C 'attach':50B,100C 'attack':44B,92C,118C 'avail':139C 'base':133C 'communic':98C 'compon':75C 'compromis':112C 'confidenti':136C 'cve':13A,16A 'cvss':131C,141C,143C 'descript':62B 'difficult':86C 'edward':3A,22B,30B,67C,74C,107C,114C,128C 'enterpriseon':4A,19B,31B,68C,108C,115C,129C 'execut':110C 'exploit':88C 'flaw':7A,41B 'h':153C 'h/a':152C 'h/i':151C 'h/pr':147C 'hardwar':103C 'host':53B 'impact':140C 'instal':6A,39B,76C 'integr':137C 'jd':2A,21B,29B,66C,73C,106C,113C,127C 'jd-edward':20B 'n/s':149C 'n/ui':148C 'network':12A,48B 'on-prem':23B 'oracl':1A,26B,28B,72C 'packag':27B 'per':59B 'physic':47B,97C 'prem':25B 'product':58B,70C 'result':123C 'score':134C 'secur':40B,77C 'segment':49B,99C 'sourc':61B 'success':117C 'support':78C 'take':55B 'takeov':9A,125C 'tool':5A,32B,69C,109C,116C,130C 'u/c':150C 'unauthent':43B,91C 'vector':142C 'version':33B,79C 'vulner':63C,89C,121C","nicknames":[],"mitigations":[],"who_affected":"Sites running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 are affected. The sources describe the attacker as needing access to the physical communication segment attached to the hardware running the tools, which makes this a network-adjacency issue rather than an internet-facing one. Teams whose tools hosts are on isolated segments with no untrusted access face lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91327","severity":null,"published_at":"2026-10-20T22:20:34+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}