CVE-2026-91299
Received Received - Intake

Authentication Bypass in JD Edwards EnterpriseOne Orchestrator

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-91299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 to 9.2.26.5. It allows unauthenticated attackers to remotely compromise the system via HTTP, potentially leading to full takeover of the Orchestrator component.

Impact Analysis

An attacker could exploit this to gain complete control over the JD Edwards EnterpriseOne Orchestrator, leading to unauthorized access, data breaches, or disruption of services. The high CVSS score (10.0) indicates severe impact on confidentiality, integrity, and availability.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data security) requirements. Organizations using affected versions may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0-9.2.26.5 to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91299. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart