Unauthorized Data Access Vulnerability in Oracle JD Edwards EnterpriseOne Tools
CVE-2026-91455

5.4MEDIUM

Key Information:

Vendor

Oracle
Status
Jd Edwards Enterpriseone Tools
Vendor
CVE Published:
20 October 2026

What is CVE-2026-91455?

A security vulnerability in Oracle's JD Edwards EnterpriseOne Tools allows an unauthenticated attacker to compromise the system through network access via HTTP. While successful exploitation requires human interaction from a third party, it can lead to unauthorized access to sensitive data, allowing attackers to update, insert, or delete data. Additionally, the vulnerability permits unauthorized read access to certain data subsets, which poses significant risks to information integrity and confidentiality.

Affected Version(s)

JD Edwards EnterpriseOne Tools 9.2.0.0 <= 9.2.26.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.