CVE-2026-91299 is a CVSS 10.0 vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator that an unauthenticated attacker with network access over HTTP can exploit to take over the product.
What Is It
CVE-2026-91299 is in the E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator. Oracle describes it as "easily exploitable." An attacker with network access over HTTP can compromise the Orchestrator without credentials and without any action from a user.
NVD published the record on 2026-10-20 with the status "Received." Oracle ([email protected]) is the source.
Why It Matters
Oracle scores the flaw at CVSS 3.1 10.0 (CRITICAL), the maximum score, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Impact: High confidentiality, integrity and availability
The scope change matters most. Oracle says that although the flaw is in JD Edwards EnterpriseOne Orchestrator, attacks "may significantly impact additional products." A successful attack can result in full takeover of the Orchestrator. The exploitability subscore is 3.9 and the impact subscore is 6.0.
Exploitation status: The supplied CISA Known Exploited Vulnerabilities (KEV) data has no entry for this CVE. KEV does not confirm active exploitation, and there is no CISA-required action or due date. That is no reason to wait: a network-reachable, unauthenticated, low-complexity flaw with a 10.0 score should be fixed first.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: JD Edwards EnterpriseOne Orchestrator
- Component: E1 IOT Orchestrator Security
- Affected versions: 9.2.0.0 through 9.2.26.5, inclusive
The NVD record lists no CPE entries yet. Teams should check their installed version against this range directly.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Administrators running an affected version should read that advisory for the fixed releases and patching guidance, then apply the update. Because the flaw can be exploited remotely over HTTP, also check whether Orchestrator endpoints are exposed to untrusted networks.
The supplied data does not list a specific fixed version number. CISA has issued no required action because the CVE is not in KEV.
Sources
- NVD: CVE-2026-91299
- Oracle Critical Patch Update Advisory, October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)