CVE-2026-91273 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Tools deployments, particularly those with versions 9.2.0.0-9.2.26.5, should assess exposure and potential data access risks. They should also review network access controls to HTTP to prevent unauthorized access and monitor for potential data access risks and unauthorized data exposure.

Why it matters

CVE-2026-91273 is a high-severity vulnerability in JD Edwards EnterpriseOne Tools that allows unauthenticated attackers to compromise data confidentiality. Defenders should prioritize verifying exposure of affected versions and assessing potential data access risks.

• Potential unauthorized access to critical data
• Possible complete access to all JD Edwards EnterpriseOne Tools accessible data
• Need to verify exposure of affected versions
• Require verification of network access controls to HTTP

Technical summary

CVE-2026-91273 is a vulnerability in JD Edwards EnterpriseOne Tools that allows unauthenticated attackers with network access via HTTP to compromise data confidentiality. The vulnerability affects versions 9.2.0.0-9.2.26.5 and has a CVSS score of 8.6. It is easily exploitable and can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. Defenders should prioritize verifying exposure of affected versions and assessing potential data access risks. The vulnerability is in JD Edwards EnterpriseOne Tools, but attacks may significantly impact additional products.

Defensive priority

Defenders should prioritize verifying exposure of JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5 and assessing potential data access risks.

Recommended defensive actions

• Verify JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5 are in use and assess exposure
• Review network access controls to HTTP to prevent unauthorized access
• Monitor for potential data access risks and unauthorized data exposure
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in JD Edwards EnterpriseOne Tools. Oracle's security alert also provides relevant information. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise data confidentiality. Defenders should verify exposure of affected versions and assess potential data access risks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.