CVE-2026-91277 in JD Edwards EnterpriseOne Orchestrator
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Oracle JD Edwards EnterpriseOne Orchestrator represents a significant security flaw within the E1 IOT Orchestrator Security component, affecting supported software versions ranging from 9.2.0.0 through 9.2.26.5. This issue stems from an insufficient access control mechanism that fails to properly enforce authentication requirements for specific API endpoints or internal services exposed by the orchestrator. As a result, the system permits unauthenticated entities to interact with sensitive operational data without presenting valid credentials or security tokens. The flaw is particularly concerning because it can be exploited remotely over standard HTTP connections, meaning an attacker does not need physical access to the network infrastructure and can initiate attacks from any location where they have connectivity to the affected service port.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-862, Missing Authorization, depending on whether the failure lies in verifying identity or enforcing permissions after authentication is theoretically established but bypassed via network-level loopholes. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), indicating that specialized conditions are not required to exploit the flaw and it can be automated easily. Crucially, the vulnerability requires no user interaction (UI:N) and has no prerequisite privileges for the attacker (PR:N). This combination makes it a high-risk issue in environments where JD Edwards EnterpriseOne is exposed to untrusted networks or the public internet without adequate perimeter security controls such as web application firewalls or strict network segmentation.
The operational impact of this vulnerability is primarily centered on confidentiality, with an integrity and availability score of none according to CVSS 3.1 metrics. Successful exploitation allows an attacker to gain unauthorized read access to a subset of data managed by the JD Edwards EnterpriseOne Orchestrator. While the scope remains limited (S:U), meaning the impact does not extend beyond the vulnerable component itself, the nature of orchestrators often involves handling sensitive business logic and integration workflows. Accessing this data could reveal internal system configurations, pending transaction details, or other operational metadata that aids in further reconnaissance. This aligns with ATT&CK technique T1078, Valid Accounts, if the attacker uses stolen credentials to bypass checks, or more accurately T1530, Data from Cloud Storage Objects, if the orchestrator exposes data stores directly. However, given the unauthenticated nature, it is closer to direct exploitation of exposed endpoints similar to T1213, Data from Information Repositories.
Mitigation strategies must focus on immediate isolation and patching. The primary remediation step is to apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne versions 9.2.0.0 through 9.2.26.5, which address the access control logic flaws in the E1 IOT Orchestrator Security component. In environments where patching cannot be implemented immediately due to operational constraints, network-level mitigations are essential. Administrators should ensure that the JD Edwards EnterpriseOne Orchestrator is not directly accessible from untrusted networks via HTTP or HTTPS. Implementing a reverse proxy with strict authentication requirements can prevent direct access to vulnerable endpoints. Additionally, deploying Web Application Firewalls (WAF) rules to detect and block requests lacking valid session tokens for orchestrator-specific paths can provide an effective layer of defense against automated exploitation attempts. Regular auditing of API endpoint exposure is also recommended to ensure no other unauthenticated services are inadvertently exposed alongside this component.