{"id":"CVE-2026-91265","published":"2026-10-20T22:20:27.557","lastModified":"2026-10-22T23:20:32.367","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The JD Edwards EnterpriseOne Tools product has a vulnerability in its Enterprise Infrastructure SEC component that allows unauthenticated attackers to bypass authentication and gain unauthorized access to critical data or modify it, due to missing or improper authentication checks.","exploitability":"This is an easily exploitable vulnerability requiring no authentication or user interaction, with only network access via HTTP needed.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality and integrity of all JD Edwards EnterpriseOne Tools accessible data, potentially affecting business-critical ERP operations.","remediation":"Upgrade to JD Edwards EnterpriseOne Tools version 9.2.26.6 or later, as this is the first supported version that addresses the vulnerability in component Enterprise Infrastructure SEC.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","erp","critical-data","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:49:19.043Z"}}