CVE-2026-91328 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Deployment SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a critical risk to organizations relying on this enterprise resource planning platform for their operational infrastructure. The core technical issue stems from an improper handling of authentication and authorization mechanisms within the deployment tools, which allows an attacker who has already established network access to the underlying server environment to escalate privileges or manipulate system states in ways that were not intended by the software architecture. While the vulnerability does not allow remote exploitation over a public network without prior foothold, it significantly lowers the barrier for internal attackers or those who have gained initial access through other means, such as phishing or compromised credentials on adjacent systems.
From an operational perspective, this flaw is particularly dangerous because it facilitates unauthorized takeover of the JD Edwards EnterpriseOne Tools environment. The CVSS 3.1 base score of 7.8 reflects a high severity level due to the complete compromise potential across confidentiality, integrity, and availability vectors. An attacker exploiting this vulnerability can potentially exfiltrate sensitive business data, alter critical configuration settings that disrupt business processes, or render the application unavailable by manipulating deployment states. The requirement for human interaction indicates that the attack vector likely involves social engineering tactics, such as tricking a legitimate user into executing a malicious script, clicking on a crafted link within the tool interface, or approving a deceptive administrative action. This dependency on user interaction does not diminish the severity but rather shifts the primary defense layer to security awareness and strict access controls.
The technical classification of this vulnerability aligns with CWE-287, which covers Improper Authentication, as well as CWE-913, concerning Control of Controller from an Uncontrolled Component if the deployment tool allows external inputs to dictate system behavior without sufficient validation. In terms of MITRE ATT&CK mapping, this scenario is consistent with techniques found under Initial Access via Trusted Relationships or Execution through User Interaction, followed by Privilege Escalation and Defense Evasion as the attacker moves laterally within the infrastructure. The low attack complexity and lack of required privileges for initial access make it a prime target for insider threats or attackers who have breached perimeter defenses but require deeper system control to achieve their objectives.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Oracle has released patches that address these specific flaws in the Deployment SEC component, making the application of the latest security updates the most effective countermeasure for affected versions 9.2.0.0 through 9.2.26.5. Organizations should prioritize patching this component immediately to close the privilege escalation gap. Beyond software updates, implementing strict network segmentation is crucial; JD Edwards servers should be isolated from general user networks and only accessible via secure, authenticated channels with multi-factor authentication enabled for all administrative interfaces. Additionally, enforcing principle of least privilege ensures that even if an attacker gains initial access, their ability to interact with the deployment tools is restricted based on role-based access controls. Regular auditing of user activities within the JD Edwards environment can also help detect anomalous behavior indicative of exploitation attempts before significant damage occurs.