Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91265updated 25 Oct 2026, 18:50 UTC

Oracle JD Edwards EnterpriseOne Tools: unauthenticated attackers can access and change data

Someone on the network can reach this business software without logging in and read, change, or delete company data. No password is needed to attempt it.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or credentials needed
  2. 2HTTP requestSent over the network to the server
  3. 3JD Edwards ToolsFlawed Enterprise Infrastructure SEC component
  4. 4Critical dataRead, modified, or deleted
  5. ResultAttacker gains access to business data

What happened

A critical flaw in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools lets an unauthenticated attacker send HTTP requests over the network to compromise the product.

Why it is dangerous: A successful attack can create, delete, or modify critical data and gain full access to everything JD Edwards EnterpriseOne Tools can reach, which puts finance, HR, and supply chain records at risk.

Are you affected?

You are affected if you run Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 with HTTP access reachable from the network.

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5

What to do

  1. Check whether your JD Edwards EnterpriseOne Tools version falls within 9.2.0.0 through 9.2.26.5.
  2. Restrict network access to JD Edwards EnterpriseOne Tools HTTP endpoints so only trusted users and networks can reach them.
  3. Apply the official Oracle Security Alert or Critical Patch Update fix for this CVE as soon as it is available.

Timeline

  1. 20 Oct 2026, 22:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:20 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91265 · GHSA-3g2q-v7mw-hfh8
CVSS
9.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:20 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle JD Edwards EnterpriseOne Tools: unauthenticated attackers can access and change data · Zero Radar