Installation Security Flaw in Oracle JD Edwards EnterpriseOne Tools
CVE-2026-91326

8.8HIGH

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Tools
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91326?

A vulnerability exists within the Installation Security component of Oracle's JD Edwards EnterpriseOne Tools. This weakness allows an unauthenticated attacker to exploit the system if they have access to the physical communication segment connected to the hardware running the JD Edwards software. Successful exploitation necessitates human interaction from a third party, which may complicate the attack vector. While the primary concern is with JD Edwards EnterpriseOne Tools, the overall impact can extend to additional products, leading to potential system takeover and severe consequences for data confidentiality, integrity, and availability.

Affected Version(s)

JD Edwards EnterpriseOne Tools 9.2.0.0 <= 9.2.26.4

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.