---
id: "CVE-2026-91328"
kind: "vulnerability"
aliases: ["CVE-2026-91328"]
title: "Oracle JD Edwards EnterpriseOne Tools: deployment flaw allows takeover of the product"
severity: "high"
cvss: 7.8
epss: 0.00124
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "jd-edwards", "on-prem", "oracle", "vendor"]
not_affected_if: ["no-local-logon-exposure", "unsupported-version-range"]
published_at: "2026-10-20T22:20:34+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91328", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91328", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: deployment flaw allows takeover of the product

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Deployment SEC component. A logged-on attacker on the infrastructure where the tools run can take over the product, with human interaction from another person required.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5 using the Oracle JD Edwards release information for your installation
- unknown for other local file or command checks, as the sources do not say

## Fix

- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that covers the Deployment SEC component; the sources do not name the fixed version
- unknown for further configuration changes

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91328
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91328

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_