{"id":"CVE-2026-91299","published":"2026-10-20T22:20:31.557","lastModified":"2026-10-23T12:18:17.050","description":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical vulnerability exists in Oracle JD Edwards EnterpriseOne Orchestrator that allows unauthenticated attackers to fully compromise the system through HTTP requests. This affects versions 9.2.0.0 through 9.2.26.5 and can lead to complete takeover of the orchestrator component.","exploitability":"The vulnerability is easily exploitable with no authentication required, allowing attackers with network access to directly compromise the system through HTTP requests without any additional preconditions.","blast_radius":"Successful exploitation could result in full compromise of JD Edwards EnterpriseOne Orchestrator and potentially impact additional related products due to the scope change in the vulnerability's impact.","remediation":"Immediate remediation is required: Disable the E1 IOT Orchestrator Security component or restrict network access to the affected HTTP endpoints until a patch is available, as no fixed version has been published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","orphaned","unauthenticated","critical"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:17:57.040Z"}}