---
id: "CVE-2026-91330"
kind: "vulnerability"
aliases: ["CVE-2026-91330"]
title: "Oracle JD Edwards EnterpriseOne Tools: local user can partly disrupt service"
severity: "low"
cvss: 3.3
epss: 0.00103
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "jd-edwards", "on-prem", "oracle", "vendor"]
not_affected_if: ["no-jde-tools", "no-local-logon"]
published_at: "2026-10-20T22:20:35+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91330", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91330", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: local user can partly disrupt service

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an Installation Security flaw. A low-privileged user who can log on to the host can cause a partial denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0-9.2.26.5 in the vendor's version records
- unknown for other checks; the sources do not give a file, command or setting to inspect

## Fix

- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the release in use; the sources do not name the patched version

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91330
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91330

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_