CVE-2026-91301 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to perform unauthorized update, insert, or delete operations on some accessible data and cause a partial denial of service. The vulnerability is difficult to exploit and has a low CVSS score of 3.6, indicating limited impact on integrity and availability without confidentiality impact.
CVE-2026-91300 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially perform unauthorized update, insert, or delete operations on accessible data. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability has a low CVSS 3.1 base score of 3.1, reflecting limited integrity impact and no confidentiality or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update, indicating that patches are available for affected versions.
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-91298 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91297 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation requires human interaction from a person other than the attacker and can lead to unauthorized update, insert, delete, and read access to some accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity with confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91296 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially take over the affected product. Successful exploitation requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8.
CVE-2026-91295 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91294 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Business Logic Infra SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to cause a partial denial of service (partial DOS) of the product. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on availability.
CVE-2026-91293 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to gain unauthorized read access to some data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on confidentiality and availability.
CVE-2026-91292 is a vulnerability in Oracle JD Edwards EnterpriseOne Localizations version 9.2. It allows a low privileged attacker with network access via JDENET to gain unauthorized read access to some accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. Oracle has released security patches addressing this vulnerability in their October 2026 Critical Patch Update.
CVE-2026-91291 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to potentially compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The vulnerability is rated with a CVSS 3.1 base score of 3.6, indicating low severity.
CVE-2026-91290 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to compromise the JD Edwards EnterpriseOne Tools environment, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91289 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the tools to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with a high confidentiality impact but no impact on integrity or availability.
CVE-2026-91288 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via JDENET to potentially create, delete, or modify critical data or gain unauthorized access to all data accessible by JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high impact on confidentiality and integrity. Oracle has released security patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91287 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the software to compromise the tools. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible by JD Edwards EnterpriseOne Tools.
CVE-2026-91286 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the software to compromise the JD Edwards EnterpriseOne Tools. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update, which includes patches for JD Edwards EnterpriseOne Tools and other affected products.
CVE-2026-91285 is a vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via HTTP to compromise the Orchestrator component. Successful exploitation can lead to unauthorized access to critical or all accessible data within the Orchestrator. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level focused on confidentiality impact.
CVE-2026-91284 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to cause a hang or repeated crash, resulting in a denial of service (DoS). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with impact on availability only.
CVE-2026-91283 is a medium severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized read access to some accessible data. Successful exploitation requires user interaction from someone other than the attacker. The vulnerability has a CVSS 3.1 base score of 4.3, indicating limited confidentiality impact without integrity or availability effects.
CVE-2026-91282 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Portal SEC component) versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, primarily impacting confidentiality. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.