CVE-2026-91325
HighCVSS 7.5Summary
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data or complete access to all data accessible in JD Edwards EnterpriseOne Tools.
Risk Assessment
Possible unauthorized access to critical data or complete access to all data in JD Edwards EnterpriseOne Tools, representing a serious confidentiality breach.
Recommendation
Immediately install the Oracle security updates for JD Edwards EnterpriseOne Tools and restrict network access to the system over HTTP.
Other vulnerabilities in JD Edwards EnterpriseOne Tools
See all- CVE-2026-91328High
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can take over the product, but human interaction is required.
- CVE-2026-91327High
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with access to the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools executes can take over the product. The vulnerability is difficult to exploit.
- CVE-2026-91326High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.4. An unauthenticated attacker with access to the physical communication segment can exploit it, requiring user interaction; attacks may impact additional products (scope change) and lead to takeover of JD Edwards EnterpriseOne Tools.
- CVE-2026-91315High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2026-91314High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2026-91313High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.4. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.
- CVE-2026-91311High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to compromise the system.
- CVE-2026-91310High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation SEC) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows a low-privileged attacker with network access via JDENET to compromise the system.
- CVE-2026-91308High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical data.
- CVE-2026-91307High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical data.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS