CVE-2026-91292

Undergoing Analysis Undergoing Analysis - In Progress

Unauthorized Data Read and DoS in JD Edwards EnterpriseOne Localizations

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD Edwards (component: LATAM). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Localizations. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Localizations accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Localizations. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-91292

EUVD

EUVD-2026-106546

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	JD Edwards EnterpriseOne Localizations	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne Localizations (version 9.2). It allows a low-privileged attacker with network access to read some data and cause partial denial of service.

Detection Guidance

Detection of CVE-2026-91292 requires monitoring JD Edwards EnterpriseOne Localizations for unauthorized network access via JDENET. Check for unusual network traffic patterns or connections to the JDENET port. Review logs for low-privileged users attempting to access restricted data or causing partial denial of service.

Impact Analysis

An attacker could access some data and disrupt services partially. This may lead to data breaches or service interruptions for users of the affected software.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to unauthorized read access to sensitive data and potential partial denial of service. Unauthorized access could lead to data breaches, violating confidentiality requirements in GDPR and HIPAA. The partial DOS may disrupt operations, affecting availability standards in these regulations.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne Localizations version 9.2 to address the vulnerability in the LATAM component.

Hi! I’m here to help you understand CVE-2026-91292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...