{"id":"CVE-2026-91384","kind":"vulnerability","aliases":["CVE-2026-91384"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user reads critical data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Web Runtime SEC component, has a flaw reachable over the network through JDENET. A user with low privileges can gain unauthorized access to critical data and to everything the Tools product can reach.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone-tools","erp","jd-edwards","oracle","vendor"],"not_affected_if":["no-network-access-to-jdenet","unsupported-version"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` through `9.2.26.5`\n- Confirm whether JDENET is reachable from networks where low-privilege users sit, using the network configuration for the Tools server","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component, moving past `9.2.26.5`\n- unknown: the sources do not name the exact fixed release","status":"open","published_at":"2026-10-20T22:20:41+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:50:52+00:00","updated_at":"2026-10-25T03:50:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:50:52Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component, moving past `9.2.26.5`\n- unknown: the sources do not name the exact fixed release","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network user reads critical data","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Web Runtime SEC component, has a flaw reachable over the network through JDENET. A user with low privileges can gain unauthorized access to critical data and to everything the Tools product can reach.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","oracle","enterpriseone-tools","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical and all Tools-accessible data","analyst_note":"Find the Oracle Security Alert or CPU advisory for this CVE to confirm the fixed release and the exact configuration; source given only NVD.","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` through `9.2.26.5`\n- Confirm whether JDENET is reachable from networks where low-privilege users sit, using the network configuration for the Tools server","needs_analyst":true,"not_affected_if":["unsupported-version","no-network-access-to-jdenet"],"who_is_affected":"Sites running JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where low-privilege users can reach JDENET over the network. Systems not on that range or not reachable from user networks can deprioritise it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3499,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91384':16A,19A '/av':146C '3.1':136C,145C '6.5':139C '9.2.0.0':91C '9.2.26.5':92C 'access':57B,102C,120C,126C,133C 'affect':89C 'allow':96C 'attack':99C,112C 'base':137C 'complet':125C 'compon':39B,81C 'compromis':106C 'confidenti':140C 'critic':12A,59B,122C 'cve':14A,17A 'cvss':135C,142C,144C 'data':13A,60B,123C,134C 'easili':93C 'edward':3A,26B,31B,73C,80C,108C,130C 'enterpriseon':4A,21B,32B,74C,109C,131C 'enterpriseone-tool':20B 'erp':23B 'everyth':63B 'exploit':94C 'flaw':42B 'gain':55B 'h/i':152C 'impact':141C 'jd':2A,25B,30B,72C,79C,107C,129C 'jd-edward':24B 'jdenet':48B,104C 'l/pr':148C 'l/ui':149C 'low':7A,52B,97C 'low-privileg':6A 'n':154C 'n/a':153C 'n/ac':147C 'n/s':150C 'network':9A,46B,101C 'oracl':1A,27B,29B,78C 'privileg':8A,53B,98C 'product':66B,76C 'reach':68B 'reachabl':43B 'read':11A 'result':117C 'runtim':37B,83C 'score':138C 'sec':38B,84C 'success':111C 'support':85C 'tool':5A,22B,33B,65B,75C,110C,132C 'u/c':151C 'unauthor':56B,119C 'user':10A,50B 'vector':143C 'vendor':28B 'version':86C 'via':103C 'vulner':69C,95C,115C 'web':36B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range where low-privilege users can reach JDENET over the network. Systems not on that range or not reachable from user networks can deprioritise it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91384","severity":null,"published_at":"2026-10-20T22:20:41+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}