CVE-2026-91328
HighCVSS 7.8Summary
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can take over the product, but human interaction is required.
Risk Assessment
Takeover of JD Edwards EnterpriseOne Tools is possible, leading to compromise of confidentiality, integrity, and availability. However, infrastructure access and user interaction are required.
Recommendation
Update JD Edwards EnterpriseOne Tools to the latest version. Restrict infrastructure access and educate users on security.
Other vulnerabilities in JD Edwards EnterpriseOne Tools
See all- CVE-2026-91327High
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with access to the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools executes can take over the product. The vulnerability is difficult to exploit.
- CVE-2026-91326High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.4. An unauthenticated attacker with access to the physical communication segment can exploit it, requiring user interaction; attacks may impact additional products (scope change) and lead to takeover of JD Edwards EnterpriseOne Tools.
- CVE-2026-91325High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized access to critical data or complete access to all data accessible in JD Edwards EnterpriseOne Tools.
- CVE-2026-91315High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2026-91314High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes can easily exploit it, requiring user interaction, leading to takeover of the system.
- CVE-2026-91313High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.4. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.
- CVE-2026-91311High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to compromise the system.
- CVE-2026-91310High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation SEC) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows a low-privileged attacker with network access via JDENET to compromise the system.
- CVE-2026-91308High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical data.
- CVE-2026-91307High
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security) affects versions 9.2.0.0-9.2.26.5. An easily exploitable flaw allows an unauthenticated attacker with network access via Oracle Net to gain unauthorized access to critical data.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS