Web Runtime Security Flaw in JD Edwards EnterpriseOne Tools by Oracle
CVE-2026-91300

3.1LOW

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Tools
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91300?

A vulnerability exists in the Web Runtime component of Oracle's JD Edwards EnterpriseOne Tools, allowing unauthenticated attackers to compromise the application. This flaw necessitates human interaction for successful exploitation, which can lead to unauthorized manipulation of data, such as updates, inserts, or deletions, within the application. Affected versions range from 9.2.0.0 to 9.2.26.5, highlighting a significant risk for enterprises utilizing this product without appropriate mitigations.

Affected Version(s)

JD Edwards EnterpriseOne Tools 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.