CVE-2026-91305
CriticalCVSS 9.1Summary
Vulnerability in JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with HTTPS network access can perform unauthorized modifications and gain access to critical data.
Risk Assessment
Possible unauthorized modifications and full data access in JD Edwards EnterpriseOne Tools, impacting confidentiality and integrity.
Recommendation
Update JD Edwards EnterpriseOne Tools to a patched version and restrict network access to trusted addresses.
Other vulnerabilities in JD Edwards EnterpriseOne Tools
See all- CVE-2026-91328High
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can take over the product, but human interaction is required.
- CVE-2026-91327High
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with access to the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools executes can take over the product. The vulnerability is difficult to exploit.
- CVE-2026-91326High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.4. An unauthenticated attacker with access to the physical communication segment can exploit it, requiring user interaction; attacks may impact additional products (scope change) and lead to takeover of JD Edwards EnterpriseOne Tools.
- CVE-2026-91325High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data or complete access to all data accessible in JD Edwards EnterpriseOne Tools.
- CVE-2026-91315High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2026-91314High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2016-0424High
An unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC.
- CVE-2016-0423High
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0422High
An unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC.
- CVE-2016-0420High
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via unknown vectors related to Monitoring and Diagnostics.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS