by Kastro
Paper/Archive/CVE-2026-91265

CVE-2026-91265

Oracle Corporation JD Edwards EnterpriseOne Tools — Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.2.362 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected

ProductAffectedFixed inSource
JD Edwards EnterpriseOne Tools9.2.0.0 – 9.2.26.5–CNA

Scores by source

oracle (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryoracle.com/security-alerts/cpuoct2026.html