CVE-2026-91265 is a critical (CVSS 9.1) vulnerability in Oracle JD Edwards EnterpriseOne Tools. An unauthenticated attacker with network access over HTTP can exploit it to read, create, modify or delete critical application data.
What Is It
CVE-2026-91265 affects the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools. Oracle reported the flaw, and NVD published it on 2026-10-20. Its NVD status is currently "Received."
Oracle describes the flaw as "easily exploitable." An attacker needs no credentials and no user interaction, only network access to the product over HTTP. A successful attack gives the attacker unauthorized access to critical data, up to all data that JD Edwards EnterpriseOne Tools can reach. It also lets the attacker create, delete or modify that data.
Why It Matters
The CVSS 3.1 base score is 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Confidentiality / Integrity Impact: High / High
- Availability Impact: None
The flaw is remotely reachable, low-complexity and needs no authentication, so any exposed instance is an easy target. JD Edwards EnterpriseOne often holds an organization's critical business data. Because both confidentiality and integrity impact are high, a successful attack could mean data theft or tampering with records.
The supplied data has no CISA KEV entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: JD Edwards EnterpriseOne Tools
- Component: Enterprise Infrastructure SEC
- Affected versions: 9.2.0.0 through 9.2.26.5 (inclusive)
Oracle notes that these are the affected supported versions. The NVD record does not yet list any CPEs.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update (CPU) advisory as the vendor reference. The supplied data does not give a fixed version number. Organizations running JD Edwards EnterpriseOne Tools 9.2.0.0–9.2.26.5 should check the October 2026 CPU advisory for remediation guidance and apply the relevant updates. Treat this as a priority, since the flaw is critical and needs no authentication.
There is no CISA KEV entry, so no federal required action or due date applies at this time.