Unauthenticated Security Flaw in Oracle JD Edwards EnterpriseOne Orchestrator
CVE-2026-91299

10CRITICAL

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Orchestrator
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91299?

A security vulnerability exists within the JD Edwards EnterpriseOne Orchestrator, enabling remote unauthenticated attackers to exploit the system via HTTP access. This flaw can lead to unauthorized control of the JD Edwards EnterpriseOne Orchestrator, potentially impacting the confidentiality, integrity, and availability of the system and connected products. The supported versions from 9.2.0.0 to 9.2.26.5 are at risk, emphasizing the need for immediate mitigation measures to prevent exploitation.

Affected Version(s)

JD Edwards EnterpriseOne Orchestrator 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.