CVE-2026-91299: Critical severity Oracle JD Edwards EnterpriseOne Orchestrator vulnerability
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Supported Oracle JD Edwards EnterpriseOne Orchestrator versions from 9.2.0.0 through 9.2.26.5 are affected. The vulnerable component is E1 IOT Orchestrator Security.
What does an attacker need to exploit this issue?
An unauthenticated attacker needs network access to the Orchestrator over HTTP. No privileges or user interaction are required, and exploitation is described as easy.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of JD Edwards EnterpriseOne Orchestrator, with high confidentiality, integrity, and availability impact. The scope change means attacks may also significantly affect additional products.