CVE-2026-91289

MediumCVSS 5.3

Published: 20/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with access to the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools executes can gain unauthorized access to critical data or all accessible data. CVSS 3.1 Base Score 5.3.

Risk Assessment

Potential leakage of critical ERP data by an attacker with local network (physical segment) access. Exploitation is difficult but confidentiality impact is severe.

Recommendation

Apply Oracle CPU updates for JD Edwards EnterpriseOne Tools and secure network segments connected to the server. Implement network segmentation and physical access control.

Other vulnerabilities in JD Edwards EnterpriseOne Tools

See all

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS