CVE-2026-91455
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component E1 Dev Platform Tech - UNIX) versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with network access via HTTP can, with user interaction, perform unauthorized updates, inserts, or deletes and gain unauthorized read access to a subset of data.
Risk Assessment
An unauthenticated attacker could modify data and access part of it, potentially leading to data corruption and confidentiality breach in the JD Edwards system.
Recommendation
Update JD Edwards EnterpriseOne Tools to the version containing Oracle's fix. Restrict network access to the system and enforce least privilege.
Other vulnerabilities in JD Edwards EnterpriseOne Tools
See all- CVE-2026-91383Medium
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Monitoring and Diagnostics SEC) affecting versions 9.2.0.0-9.2.26.5. A difficult-to-exploit flaw allows a high-privileged attacker with HTTP network access to compromise the product, and attacks may significantly impact additional products (scope change).
- CVE-2016-0424High
An unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC.
- CVE-2016-0423High
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0422High
An unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC.
- CVE-2016-0420High
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via unknown vectors related to Monitoring and Diagnostics.
- CVE-2014-6565High
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Portal SEC.
- CVE-2026-91305Critical
Vulnerability in JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with HTTPS network access can perform unauthorized modifications and gain access to critical data.
- CVE-2026-91265Critical
Vulnerability in JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0-9.2.26.5. An unauthenticated attacker with HTTP network access can perform unauthorized modifications and gain access to critical data.
- CVE-2026-61272Critical
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Web Runtime SEC). Affected versions are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8.
- CVE-2026-60627Critical
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security). Affected version is 9.2.26.3. A low-privileged attacker with network access via HTTP can compromise the tools, potentially impacting other products.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS