CVE-2026-91305 is a critical (CVSS 9.1) vulnerability in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools that an unauthenticated attacker can exploit over HTTPS to read, create, modify, or delete critical data.
What Is It
CVE-2026-91305 is in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access over HTTPS can use it to compromise JD Edwards EnterpriseOne Tools.
Oracle ([email protected]) assigned it a CVSS 3.1 base score of 9.1 (Critical):
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High confidentiality, high integrity, no availability impact
NVD published the record on 2026-10-20 with a status of "Received." NVD has not yet completed its analysis.
Why It Matters
The attacker needs no credentials and no user interaction, and the attack complexity is low. According to the vendor description, a successful attack can lead to:
- Unauthorized creation, deletion, or modification of critical data, or of all data accessible to JD Edwards EnterpriseOne Tools
- Unauthorized access to critical data, or complete access to all data accessible to JD Edwards EnterpriseOne Tools
JD Edwards EnterpriseOne is an enterprise resource planning (ERP) platform, so the data at risk here is core business data.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so CISA has not confirmed active exploitation. The supplied sources contain no other reports of exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: JD Edwards EnterpriseOne Tools
- Component: Installation Security
- Affected versions: 9.2.0.0 through 9.2.26.5 (inclusive)
The NVD record does not list any CPE entries yet.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). Organizations running JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 should check that advisory for fixed versions and remediation guidance, and apply the update. Because the flaw requires no authentication and is reachable over the network, it should be prioritized.
Since there is no KEV listing, there is no CISA-mandated required action or due date for this CVE.