CVE-2026-91267 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Tools, security teams assessing network exposure, and administrators of affected versions should prioritize assessing exposure and verifying remediation.

Why it matters

CVE-2026-91267 is a high-severity vulnerability in JD Edwards EnterpriseOne Tools that allows unauthenticated attackers to compromise the product and access critical data. Defenders should assess exposure, verify remediation, and monitor for unauthorized access attempts due to the high CVSS score and potential scope change.

• Potential unauthorized access to critical data
• Possible scope change impacting additional products
• Need for verification of affected versions and remediation status
• Importance of monitoring for unauthorized access attempts

Technical summary

The vulnerability in JD Edwards EnterpriseOne Tools (component: Interoperability SEC) allows unauthenticated attackers with network access via SOAP to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. The CVSS 3.1 Base Score is 8.6 (Confidentiality impacts). The vulnerability affects versions 9.2.0.0-9.2.26.5 and has a high CVSS score of 8.6, indicating a high severity. Defenders should assess exposure, verify remediation, and monitor for unauthorized access attempts due to the potential scope change and high CVSS score.

Defensive priority

High priority for defenders to assess exposure and verify remediation due to the high CVSS score and potential scope change.

Recommended defensive actions

• Assess exposure of JD Edwards EnterpriseOne Tools in your environment
• Verify if your version is within the affected range (9.2.0.0-9.2.26.5)
• Review network access controls to SOAP
• Monitor for unauthorized access attempts
• Consider compensating controls until official remediation is available

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its CVSS score, and potential impacts. Oracle's security alert page may contain additional details. The vulnerability has been assessed as High severity with a CVSS 3.1 Base Score of 8.6. The NVD entry is currently Undergoing Analysis. Defenders should verify affected versions, review network access controls to SOAP, and monitor for unauthorized access attempts. The CVE record was published on 2026-10-20T22:20:27.773Z and has not been modified since then. The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.