---
id: "CVE-2026-91384"
kind: "vulnerability"
aliases: ["CVE-2026-91384"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege network user reads critical data"
severity: "medium"
cvss: 6.5
epss: 0.0027
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone-tools", "erp", "jd-edwards", "oracle", "vendor"]
not_affected_if: ["no-network-access-to-jdenet", "unsupported-version"]
published_at: "2026-10-20T22:20:41+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91384", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91384", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege network user reads critical data

Oracle JD Edwards EnterpriseOne Tools, in the Web Runtime SEC component, has a flaw reachable over the network through JDENET. A user with low privileges can gain unauthorized access to critical data and to everything the Tools product can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EnterpriseOne Tools release against the affected range `9.2.0.0` through `9.2.26.5`
- Confirm whether JDENET is reachable from networks where low-privilege users sit, using the network configuration for the Tools server

## Fix

- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools that covers the Web Runtime SEC component, moving past `9.2.26.5`
- unknown: the sources do not name the exact fixed release

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91384
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91384

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_