CVE-2026-91384
MediumCVSS 6.5Summary
Vulnerability in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.5). A low-privileged attacker with JDENET network access can gain unauthorized access to critical data or all data accessible in the product.
Risk Assessment
Critical business data from the JD Edwards system may be leaked, posing a serious confidentiality risk.
Recommendation
Update Oracle JD Edwards EnterpriseOne Tools to a version containing the security fix.
Other vulnerabilities in Oracle JD Edwards EnterpriseOne Tools
See all- CVE-2026-87330Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX component) affecting versions 9.2.0.0-9.2.26.5. A high-privileged attacker with logon can perform unauthorized modification, read data, and cause partial denial of service.
- CVE-2026-87329Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. A low-privileged attacker with logon can create, delete, or modify critical data, read a subset, and cause hang or repeatable crashes (complete DoS).
- CVE-2026-87328Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with JDENET network access can gain unauthorized access to critical data.
- CVE-2026-87327Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with access to the physical communication segment can access and modify critical data.
- CVE-2026-87326Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with HTTP network access can gain unauthorized access to critical data.
- CVE-2026-87325Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. A low-privileged attacker with JDENET network access can cause hang or repeatable crashes (complete DoS), modify data, and read a subset.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS