CVE-2026-91383

MediumCVSS 6.6

Published: 20/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Monitoring and Diagnostics SEC) affecting versions 9.2.0.0-9.2.26.5. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access to compromise the product, and attacks may significantly impact additional products (scope change).

Risk Assessment

Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert or delete access to data, potentially affecting related products. High privileges are required, limiting exposure, but impact can be severe.

Recommendation

Apply the security updates provided by Oracle for JD Edwards EnterpriseOne Tools and restrict network access to the Monitoring and Diagnostics SEC component to trusted administrators.

Other vulnerabilities in JD Edwards EnterpriseOne Tools

See all

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS