Oracle JD Edwards Tools Has Critical Unauthenticated Remote Flaw

Oracle JD Edwards EnterpriseOne Tools contains a critical security vulnerability that allows unauthenticated attackers to compromise the software remotely. The National Vulnerability Database (NVD) has assigned the flaw CVE-2026-91305 with a CVSS score of 9.1, rating it as critical severity. The issue resides within the Installation Security component of the product.

According to the NVD record, the vulnerability is easily exploitable over HTTPS by any attacker with network access. Successful exploitation results in unauthorized creation, deletion, or modification of critical data. Attackers can also gain complete access to all data accessible via JD Edwards EnterpriseOne Tools. The CVSS vector indicates high impacts on confidentiality and integrity, with no requirement for user interaction or prior authentication.

Technical Details and Impact

The vulnerability enables unauthorized access and data manipulation without any credentials. The NVD describes the attack vector as network-based with low complexity. An attacker needs only network access via HTTPS to trigger the flaw. The impact includes unauthorized access to critical data and the ability to alter or delete information within the system. The CVSS 3.1 base score of 9.1 reflects the severe risk to both data confidentiality and integrity.

The flaw affects the Installation Security component specifically. The NVD notes that the vulnerability allows compromise of JD Edwards EnterpriseOne Tools entirely. There is no mention of a workaround or patch in the provided source material. The record states that successful attacks can result in unauthorized access to all accessible data.

Affected Versions

The vulnerability affects a wide range of supported versions. According to the NVD, JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are impacted. Organizations running any version within this range are potentially exposed to remote attacks. The NVD record lists these specific versions as supported versions that are affected.

Oracle JD Edwards is a suite of enterprise resource planning applications. The Tools component provides the underlying framework for these applications. A compromise at this level can affect the entire ecosystem. The NVD record does not specify a release date for the vulnerability discovery or a timeline for remediation.

What should you do?

Organizations should immediately verify which versions of JD Edwards EnterpriseOne Tools they are running. If they fall within the affected range, they should assume the system is vulnerable. Network segmentation and strict firewall rules can help limit exposure. Monitoring for unusual HTTPS traffic to the application may reveal exploitation attempts.

What to do and how to stay safe: Oracle

• Inventory all systems running JD Edwards EnterpriseOne Tools to identify versions between 9.2.0.0 and 9.2.26.5.
• Restrict network access to the application to trusted IPs only, reducing the attack surface for unauthenticated remote attacks.
• Monitor server logs for suspicious HTTPS requests that do not correspond to legitimate user activity or scheduled jobs.
• Prepare to apply patches immediately once Oracle releases an update for CVE-2026-91305, as no fix has been confirmed yet.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-91305?

It is a critical vulnerability in Oracle JD Edwards EnterpriseOne Tools that allows unauthenticated remote attackers to compromise installation security and data.

Which versions of JD Edwards are affected?

Versions 9.2.0.0 through 9.2.26.5 of JD Edwards EnterpriseOne Tools are affected by this vulnerability.

Can an attacker exploit this flaw remotely?

Yes, the vulnerability is easily exploitable over HTTPS by unauthenticated attackers with network access.