Oracle JD Edwards Tools Vulnerability Allows Unauthenticated Data Manipulation
A critical flaw in Oracle JD Edwards EnterpriseOne Tools permits remote attackers to modify or delete data without credentials.
Key points
- CVE-2026-91265 affects Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5.
- The vulnerability carries a CVSS 3.1 Base Score of 9.1, rated as Critical.
- Attackers can exploit the flaw via HTTP without authentication to alter critical data.
Oracle JD Edwards EnterpriseOne Tools contains a critical vulnerability that allows unauthenticated attackers with network access to compromise the system. The flaw, tracked as CVE-2026-91265, resides in the Enterprise Infrastructure SEC component and enables remote exploitation via HTTP.
Security researchers and the National Vulnerability Database rate the issue with a CVSS 3.1 Base Score of 9.1. This high score reflects the ease of exploitation and the severe impact on data confidentiality and integrity. Attackers require no user interaction or credentials to initiate the attack vector.
Technical Details of the Flaw
The vulnerability is classified as easily exploitable because it does not require authentication or user interaction. An attacker with network access can send HTTP requests to trigger the compromise. The CVSS vector indicates that the attack vector is network-based, with low complexity and no privileges required.
Successful exploitation results in unauthorized creation, deletion, or modification of access to critical data. Attackers can also gain unauthorized access to critical data or complete access to all data accessible through JD Edwards EnterpriseOne Tools. The impact on availability is rated as none, but confidentiality and integrity are both heavily compromised.
Affected Versions and Scope
The vulnerability affects specific versions of the JD Edwards EnterpriseOne Tools product. According to the NVD record, supported versions ranging from 9.2.0.0 to 9.2.26.5 are affected. Organizations using these versions of the Enterprise Infrastructure SEC component are exposed to the risk.
The flaw is limited to the JD Edwards product line from Oracle. It does not appear to affect other Oracle products or unrelated enterprise resource planning systems. The scope of the vulnerability is confined to the specific component identified in the advisory.
What should you do?
Organizations should verify their current version of JD Edwards EnterpriseOne Tools against the affected list. If running versions 9.2.0.0 through 9.2.26.5, the system is vulnerable. Network administrators should monitor for unusual HTTP traffic targeting the Enterprise Infrastructure SEC component.
What to do and how to stay safe: Oracle
- Inventory all systems running Oracle JD Edwards EnterpriseOne Tools to identify versions between 9.2.0.0 and 9.2.26.5.
- Restrict network access to the JD Edwards application servers to limit exposure to untrusted networks.
- Monitor HTTP logs for unauthorized attempts to create, delete, or modify data in the Enterprise Infrastructure SEC component.
- Await official security updates from Oracle and test them in a non-production environment before deployment.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE ID tracks this Oracle JD Edwards vulnerability?
The vulnerability is tracked under CVE-2026-91265.
What is the severity rating for CVE-2026-91265?
It is rated Critical with a CVSS 3.1 Base Score of 9.1.
Can attackers exploit this flaw without logging in?
Yes, the vulnerability allows unauthenticated attackers to exploit the system via HTTP.
