Privilege Escalation in JD Edwards EnterpriseOne Tools

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-91311

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	JD Edwards EnterpriseOne Tools 9.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 to 9.2.26.5) that allows a low-privileged attacker with system access to take over the application. The flaw exists in the Installation Security component and has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability.

Impact Analysis

If exploited, an attacker could gain full control of JD Edwards EnterpriseOne Tools, potentially leading to unauthorized access to sensitive data, system manipulation, or disruption of services. This requires the attacker to already have logon access to the infrastructure.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne Tools version 9.2.0.0 to 9.2.26.5. Ensure only authorized users have logon access to the infrastructure where this software executes. Review and restrict user privileges to minimize potential attack surface.

Hi! I’m here to help you understand CVE-2026-91311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70