Oracle JD Edwards Orchestrator Has Critical Unauthenticated Takeover Flaw

Oracle JD Edwards EnterpriseOne Orchestrator contains a critical vulnerability that enables unauthenticated attackers to take complete control of the system. The flaw, tracked as CVE-2026-91299, carries a CVSS base score of 10.0, indicating maximum severity for confidentiality, integrity, and availability impacts.

The vulnerability resides within the E1 IOT Orchestrator Security component. According to the National Vulnerability Database record, an attacker with network access via HTTP can exploit this weakness without any form of authentication. The ease of exploitation is rated as low complexity, requiring no user interaction to trigger the compromise.

Scope and Impact

The consequences of a successful attack are severe. An adversary can achieve full takeover of the JD Edwards EnterpriseOne Orchestrator. The National Vulnerability Database notes that while the vulnerability exists specifically within the Orchestrator, attacks may significantly impact additional products due to scope change. This means the breach could extend beyond the immediate component to affect other parts of the JD Edwards ecosystem.

The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms that the attack vector is network-based. The scope change designation highlights that the security boundary is crossed, potentially allowing the attacker to influence systems outside the vulnerable component. This amplifies the risk profile for organizations relying on JD Edwards for enterprise operations.

Affected Versions

Support for specific versions determines exposure. The vulnerability affects JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5. Any deployment running within this version range is susceptible to the unauthenticated takeover attack. Organizations must verify their current version against this list to determine if they are at risk.

There is no mention of a patch or fix in the provided source material. Consequently, no confirmed remediation is available yet. Users of the affected versions should assume their systems are vulnerable until Oracle releases an update or mitigation guidance. The lack of authentication requirements makes this a high-priority issue for security teams.

What should you do?

Security professionals should immediately audit their JD Edwards environments to identify if any systems are running versions 9.2.0.0 to 9.2.26.5. Network segmentation should be reviewed to limit HTTP access to the Orchestrator component. Monitoring for unusual outbound traffic or unauthorized configuration changes is advisable while awaiting vendor guidance.

What to do and how to stay safe: Oracle

• Inventory all JD Edwards EnterpriseOne Orchestrator installations to check for versions 9.2.0.0 through 9.2.26.5.
• Restrict network access to the Orchestrator HTTP endpoints to trusted management networks only.
• Monitor system logs for signs of unauthorized access or unexpected process execution on affected hosts.
• Await official vendor updates or patches before assuming the vulnerability is resolved.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91299?

The CVSS 3.1 Base Score is 10.0, which is rated as critical severity.

Which versions of JD Edwards are affected?

Versions 9.2.0.0 through 9.2.26.5 of JD Edwards EnterpriseOne Orchestrator are affected.

Is authentication required to exploit this flaw?

No, the vulnerability allows an unauthenticated attacker to compromise the system via HTTP.