Unauthenticated Access Vulnerability in Oracle JD Edwards EnterpriseOne Tools
CVE-2026-91328

7.8HIGH

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Tools
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91328?

An unauthenticated access vulnerability has been identified in Oracle's JD Edwards EnterpriseOne Tools product, specifically within the Deployment SEC component. This flaw allows attackers with access to the infrastructure hosting JD Edwards EnterpriseOne Tools to compromise its security. While successful exploitation necessitates human interaction from a third party, it poses a significant risk as it can lead to unauthorized control over the application. Affected versions range from 9.2.0.0 to 9.2.26.5. Organizations utilizing this product are advised to assess their systems and apply necessary security measures.

Affected Version(s)

JD Edwards EnterpriseOne Tools 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.