CVE-2026-91295 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Tools deployments, particularly those with versions 9.2.0.0-9.2.26.5, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability and apply necessary patches or mitigations.

Why it matters

Defenders should prioritize verifying exposure and applying remediation for JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5, as a low-privileged attacker with network access via HTTP can compromise the system, potentially leading to takeover, data exposure, tampering, and system downtime.

• Potential system compromise and takeover by low-privileged attackers
• Exposure of sensitive data due to confidentiality impact
• Integrity impact potentially leading to data tampering
• Availability impact potentially leading to system downtime

Technical summary

A vulnerability in JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) allows low-privileged attackers with network access via HTTP to compromise the system, potentially leading to takeover. The CVSS 3.1 Base Score is 8.8 (Confidentiality, Integrity and Availability impacts). The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. Defenders should prioritize verifying exposure and applying remediation.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation for JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5, as a low-privileged attacker with network access via HTTP can compromise the system.

Recommended defensive actions

• Verify JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5 for exposure
• Apply remediation as recommended by the vendor
• Monitor for potential low-privileged attacks with network access via HTTP
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in JD Edwards EnterpriseOne Tools, allowing for low-privileged attackers to compromise the system. However, specific details on affected versions and remediation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.