CVE-2026-61265: High severity Oracle JD Edwards EnterpriseOne Orchestrator vulnerability
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle JD Edwards E1 IOT Orchestrator Security (JD Edwards EnterpriseOne Orchestrator)to a version that resolves this vulnerability.Fixed in 9.2.26.4
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are 9.2.0.0 through 9.2.26.4 of Oracle JD Edwards EnterpriseOne Orchestrator, specifically the E1 IOT Orchestrator Security component.
Does an attacker need credentials or user interaction to exploit this issue?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via TLS, and it does not require user interaction. Exploitation is rated difficult, reflecting the high attack complexity.
What is the potential impact of a successful attack?
A successful attack can result in takeover of JD Edwards EnterpriseOne Orchestrator, with high confidentiality, integrity, and availability impact.