CVE-2026-91327: High severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. Exploitation requires access to the physical communication segment connected to the hardware running the product.
Does an attacker need credentials or user interaction to exploit it?
No. The vulnerability can be exploited by an unauthenticated attacker, and no user interaction is required, but exploitation is described as difficult.
What could happen if exploitation succeeds?
A successful attack can result in takeover of JD Edwards EnterpriseOne Tools, with high impacts to confidentiality, integrity, and availability.