CVE-2026-91276 in JD Edwards EnterpriseOne Orchestrator
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the JD Edwards EnterpriseOne Orchestrator component, specifically affecting versions ranging from 9.2.0.0 to 9.2.26.5 of Oracle JD Edwards. This security flaw is classified under E1 IOT Orchestrator Security and represents a significant risk due to its potential for unauthorized data access despite requiring specific conditions for exploitation. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, although it is characterized as difficult to exploit because it necessitates human interaction from a user other than the attacker. This requirement for social engineering or user manipulation significantly raises the barrier to entry for malicious actors but does not eliminate the risk entirely, particularly in environments where users may be prone to clicking on deceptive links or interacting with untrusted content while logged into the application.
From a technical perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-79 Cross-site Scripting if the exploitation involves injecting malicious scripts that are then executed by an unsuspecting user. The attack vector is classified as Network-based with High Attack Complexity and requires User Interaction, which corresponds to ATT&CK technique T1566 Phishing or similar social engineering tactics where a victim must perform an action such as clicking a link or opening a file. Once the human interaction occurs, the attacker can leverage this trust boundary violation to gain unauthorized access to critical data within the JD Edwards EnterpriseOne Orchestrator environment. The impact is primarily focused on Confidentiality, indicating that while integrity and availability may remain intact in many scenarios, sensitive business information stored within the orchestrator becomes accessible to external parties who have successfully manipulated a user into triggering the exploit.
The operational impact of this vulnerability is severe due to the nature of JD Edwards EnterpriseOne as an enterprise resource planning platform handling critical financial, supply chain, and human resources data. A successful exploitation can lead to complete access to all JD Edwards EnterpriseOne Orchestrator accessible data, exposing proprietary business logic, customer information, and internal processes to competitors or malicious actors. This level of data exposure violates fundamental principles of confidentiality and trust within enterprise IT infrastructure. The CVSS 3.1 Base Score of 5.3 reflects a medium severity rating, driven by the high attack complexity and user interaction requirements, yet it remains concerning because automated tools can facilitate the initial delivery mechanisms required to trigger human interaction, such as mass phishing campaigns or compromised websites hosting malicious content targeting employees with access to the system.
Mitigation strategies should focus on both technical controls and organizational policies. Administrators are strongly advised to apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne Orchestrator immediately, ensuring that all supported versions within the affected range are updated beyond version 9.2.26.5 or to any subsequent secure release. In addition to patching, organizations should implement strict access controls and network segmentation to limit HTTP exposure of the orchestrator components to only necessary internal subnets where possible. Security awareness training is critical in this context; employees must be educated on recognizing phishing attempts and suspicious links that could trigger such vulnerabilities requiring user interaction. Furthermore, deploying web application firewalls with advanced behavioral analysis capabilities can help detect and block exploitation attempts even if a vulnerability exists, providing an additional layer of defense against social engineering-driven attacks targeting the JD Edwards environment.