{"id":"CVE-2026-91330","kind":"vulnerability","aliases":["CVE-2026-91330"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: local user can partly disrupt service","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. A low-privileged user who can log on to the host can cause a partial denial of service.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["no-jde-tools","no-local-logon"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0-9.2.26.5 in the vendor's version records\n- unknown for other checks; the sources do not give a file, command or setting to inspect","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the release in use; the sources do not name the patched version","status":"open","published_at":"2026-10-20T22:20:35+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:46:01+00:00","updated_at":"2026-10-25T04:46:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:46:01Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the release in use; the sources do not name the patched version","reach":"local","title":"Oracle JD Edwards EnterpriseOne Tools: local user can partly disrupt service","impact":"low","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. A low-privileged user who can log on to the host can cause a partial denial of service.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Partial denial of service of EnterpriseOne Tools","analyst_note":"","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0-9.2.26.5 in the vendor's version records\n- unknown for other checks; the sources do not give a file, command or setting to inspect","needs_analyst":false,"not_affected_if":["no-jde-tools","no-local-logon"],"who_is_affected":"Organisations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where local logon to the server is possible. The sources describe only a local, low-privilege attacker and an availability impact, so internet-only exposure is not indicated. Teams not running JD Edwards EnterpriseOne Tools can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":3513,"output_tokens":580,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91330':14A,17A '/av':142C '3.1':132C,141C '3.3':135C '9.2.0.0':33B,81C '9.2.26.5':35B,82C 'abil':116C 'affect':79C 'allow':86C 'attack':89C,108C 'avail':136C 'base':133C 'caus':54B,118C 'compon':72C 'compromis':102C 'cve':12A,15A 'cvss':131C,138C,140C 'denial':57B,121C 'disrupt':10A 'dos':125C 'easili':83C 'edward':3A,21B,29B,64C,71C,97C,104C,128C 'enterpriseon':4A,18B,30B,65C,98C,105C,129C 'execut':100C 'exploit':84C 'flaw':40B 'host':52B 'impact':137C 'infrastructur':94C 'instal':38B,73C 'jd':2A,20B,28B,63C,70C,96C,103C,127C 'jd-edward':19B 'l':150C 'l/ac':143C 'l/pr':144C 'l/ui':145C 'local':6A 'log':48B 'logon':91C 'low':43B,87C 'low-privileg':42B 'n/a':149C 'n/i':148C 'n/s':146C 'on-prem':22B 'oracl':1A,25B,27B,69C 'part':9A 'partial':56B,120C,124C 'prem':24B 'privileg':44B,88C 'product':67C 'result':113C 'score':134C 'secur':39B,74C 'servic':11A,59B,123C 'success':107C 'support':75C 'tool':5A,31B,66C,99C,106C,130C 'u/c':147C 'unauthor':115C 'user':7A,45B 'vector':139C 'vendor':26B 'version':32B,76C 'vulner':60C,85C,111C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where local logon to the server is possible. The sources describe only a local, low-privilege attacker and an availability impact, so internet-only exposure is not indicated. Teams not running JD Edwards EnterpriseOne Tools can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91330","severity":null,"published_at":"2026-10-20T22:20:35+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}