Zero Radar
← feed
CriticalVulnerabilityCVE-2026-91305updated 25 Oct 2026, 18:50 UTC

Oracle JD Edwards EnterpriseOne Tools can be taken over without a login

Attackers on the network can reach a business software system over HTTPS without a password and read, change, or delete company data. The flaw is in the installation security of the product.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login credentials needed
  2. 2HTTPS requestReaches the network-facing interface
  3. 3EnterpriseOne ToolsInstallation security flaw is exploited
  4. 4Critical dataRead, modified, or deleted
  5. ResultAttacker gains unauthorized data access

What happened

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have an installation security flaw that lets an unauthenticated attacker with network access compromise the product over HTTPS.

Why it is dangerous: A successful attack can create, delete, or modify critical data and gain complete access to all data the tools can reach. Organizations running this ERP software on networks reachable by attackers are at risk.

Are you affected?

You are affected if you run Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range and it is reachable over the network via HTTPS.

Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5

What to do

  1. Check whether your JD Edwards EnterpriseOne Tools version falls within 9.2.0.0 to 9.2.26.5.
  2. Restrict network access to the JD Edwards EnterpriseOne Tools HTTPS interface to trusted users only.
  3. Apply the fix from Oracle's Security Alert or the vendor advisory as soon as it is available for your version.

Timeline

  1. 20 Oct 2026, 22:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:20 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-91305 · GHSA-p8x5-qc82-49pv
CVSS
9.1 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:20 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle JD Edwards EnterpriseOne Tools can be taken over without a login · Zero Radar