CVE-2026-91285 Oracle Corporation CVE debrief

Who should care

JD Edwards EnterpriseOne Orchestrator users and administrators should assess their exposure and take defensive actions to address this vulnerability. This includes validating exposure, applying patches or updates provided by Oracle, and monitoring for suspicious activity. Defenders should focus on validating exposure, applying patches, and monitoring for unauthorized access attempts via HTTP.

Why it matters

CVE-2026-91285 is a medium-severity vulnerability in JD Edwards EnterpriseOne Orchestrator that allows low-privileged attackers to potentially access critical data. Defenders should validate exposure, apply patches, and monitor for suspicious activity.

• Potential unauthorized access to critical data requires verification and monitoring.
• Low-privileged attackers with network access via HTTP can compromise the system.
• Defensive actions should focus on validating exposure, applying patches, and monitoring for suspicious activity.

Technical summary

The vulnerability in JD Edwards EnterpriseOne Orchestrator, with a CVSS score of 6.5, allows low-privileged attackers with network access via HTTP to compromise the system, potentially leading to unauthorized access to critical data. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a high impact on confidentiality. This medium-severity vulnerability affects versions 9.2.0.0-9.2.26.5. Defenders should assess exposure, apply patches, and monitor for suspicious activity to mitigate potential risks.

Defensive priority

Medium-priority defensive actions are recommended to address this vulnerability, focusing on validating exposure, applying patches, and monitoring for suspicious activity.

Recommended defensive actions

• Validate exposure by checking if JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0-9.2.26.5 are in use.
• Apply patches or updates provided by Oracle to address the vulnerability.
• Monitor for suspicious activity, particularly unauthorized access attempts via HTTP.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and vector. Oracle's security alert page also provides relevant details. The vulnerability affects JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0-9.2.26.5. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a high impact on confidentiality. Defenders should verify exposure and monitor for unauthorized access attempts via HTTP.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.