Installation Security Vulnerability in Oracle JD Edwards EnterpriseOne Tools
CVE-2026-91305

9.1CRITICAL

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Tools
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91305?

A security flaw in Oracle's JD Edwards EnterpriseOne Tools enables an unauthenticated attacker to gain network access via HTTPS. This vulnerability allows for the unauthorized creation, deletion, or modification of critical data within affected versions of JD Edwards EnterpriseOne Tools. Consequently, attackers can achieve access to sensitive information and possibly take control of all JD Edwards Systems data, posing significant security risks to organizations utilizing these tools.

Affected Version(s)

JD Edwards EnterpriseOne Tools 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.