{"id":"CVE-2026-91328","kind":"vulnerability","aliases":["CVE-2026-91328"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: deployment flaw allows takeover of the product","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Deployment SEC component. A logged-on attacker on the infrastructure where the tools run can take over the product, with human interaction from another person required.","severity":"high","cvss":7.8,"epss":0.00124,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["no-local-logon-exposure","unsupported-version-range"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5 using the Oracle JD Edwards release information for your installation\n- unknown for other local file or command checks, as the sources do not say","fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Deployment SEC component; the sources do not name the fixed version\n- unknown for further configuration changes","status":"open","published_at":"2026-10-20T22:20:34+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:08:43+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:08:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Deployment SEC component; the sources do not name the fixed version\n- unknown for further configuration changes","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: deployment flaw allows takeover of the product","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Deployment SEC component. A logged-on attacker on the infrastructure where the tools run can take over the product, with human interaction from another person required.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the EnterpriseOne Tools product on the host","analyst_note":"Find the Oracle CPU advisory and the fixed release number for the Deployment SEC component; the NVD entry gives no fix version.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5 using the Oracle JD Edwards release information for your installation\n- unknown for other local file or command checks, as the sources do not say","needs_analyst":true,"not_affected_if":["unsupported-version-range","no-local-logon-exposure"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range are affected. The attacker must already have a logon on the infrastructure where the tools execute, and a second person must take an action for the attack to succeed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":3531,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91328':15A,18A '/av':155C '3.1':142C,154C '7.8':145C '9.2.0.0':34B,90C '9.2.26.5':36B,91C 'affect':88C 'allow':8A,95C 'anoth':66B 'attack':49B,97C,116C,126C,128C 'avail':149C 'base':143C 'compon':44B,81C 'compromis':110C 'confidenti':146C 'contain':37B 'cve':13A,16A 'cvss':141C,151C,153C 'deploy':6A,42B,82C 'easili':92C 'edward':3A,22B,30B,73C,80C,105C,112C,138C 'enterpriseon':4A,19B,31B,74C,106C,113C,139C 'execut':108C 'exploit':93C 'flaw':7A,39B 'h':163C 'h/a':162C 'h/i':161C 'human':63B,118C 'impact':150C 'infrastructur':52B,102C 'integr':147C 'interact':64B,119C 'jd':2A,21B,29B,72C,79C,104C,111C,137C 'jd-edward':20B 'l/ac':156C 'l/pr':157C 'log':47B 'logged-on':46B 'logon':99C 'n/ui':158C 'on-prem':23B 'oracl':1A,26B,28B,78C 'person':67B,122C 'prem':25B 'product':12A,61B,76C 'r/s':159C 'requir':68B,117C 'result':133C 'run':56B 'score':144C 'sec':43B,83C 'success':115C,127C 'support':84C 'take':58B 'takeov':9A,135C 'tool':5A,32B,55B,75C,107C,114C,140C 'u/c':160C 'unauthent':96C 'vector':152C 'vendor':27B 'version':33B,85C 'vulner':69C,94C,131C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range are affected. The attacker must already have a logon on the infrastructure where the tools execute, and a second person must take an action for the attack to succeed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91328","severity":null,"published_at":"2026-10-20T22:20:34+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91328","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91328","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}