Unauthenticated Network Vulnerability in JD Edwards EnterpriseOne Orchestrator by Oracle
CVE-2026-91276

5.3MEDIUM

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Orchestrator
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91276?

An unauthenticated access vulnerability exists in the JD Edwards EnterpriseOne Orchestrator component of Oracle JD Edwards. This flaw permits attackers with network access through HTTP to target the Orchestrator, potentially leading to unauthorized access to sensitive data. Although exploitation demands human interaction from a separate individual, the ramifications include the risk of a complete data breach of all accessible JD Edwards EnterpriseOne information, stressing the need for immediate action and security updates.

Affected Version(s)

JD Edwards EnterpriseOne Orchestrator 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.