CVE-2026-91281 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can lead to unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. Oracle has released patches as part of its October 2026 Critical Patch Update to address this and other vulnerabilities.
CVE-2026-91280 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data and unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91279 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can lead to unauthorized update, insert, delete, and read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91278 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released patches for this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91277 is a vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some data accessible by the Orchestrator. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91276 is a vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data. Exploitation is difficult and requires human interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity with confidentiality impact only. Oracle has released security patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-91275 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a high privileged attacker with network access via SQL to compromise the product, potentially impacting additional products. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of accessible data. The vulnerability has a CVSS 3.1 base score of 6.6, indicating medium severity.
CVE-2026-91274 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data or full access to all accessible data within JD Edwards EnterpriseOne Tools. The attacker may also perform unauthorized update, insert, or delete operations on some data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5.
CVE-2026-91273 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical data. The vulnerability impacts confidentiality but does not affect integrity or availability. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update.
CVE-2026-91272 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTPS to potentially compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high impact on confidentiality and integrity.
CVE-2026-91271 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity without affecting availability. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91270 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically in the Monitoring and Diagnostics SEC component. It affects versions from 9.2.0.0 through 9.2.26.5. The flaw allows a low-privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91269 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low-privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity but does not affect availability. Oracle has released security patches addressing this issue as part of their October 2026 Critical Patch Update.
CVE-2026-91268 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update, which includes security patches for JD Edwards EnterpriseOne Tools among many other products.
CVE-2026-91267 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Interoperability SEC) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via SOAP to compromise the product, potentially leading to unauthorized access to critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 8.6, indicating a significant confidentiality impact with no required privileges or user interaction. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
CVE-2026-91266 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to compromise the JD Edwards EnterpriseOne Tools, potentially impacting additional products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by JD Edwards EnterpriseOne Tools, with significant confidentiality and integrity impacts.
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91264 is a vulnerability in Oracle PeopleSoft Enterprise SCM Manufacturing version 9.2 that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is difficult to exploit and has a low CVSS 3.1 base score of 3.7, reflecting limited integrity impact without confidentiality or availability effects. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches addressing this and many other vulnerabilities are available.
CVE-2026-91263 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Notification Configuration component affecting versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible PeopleSoft Enterprise PeopleTools data. The vulnerability is difficult to exploit and has a CVSS 3.1 base score of 4.9, indicating medium severity. The vulnerability may also impact additional Oracle products due to scope change. Oracle has released a Critical Patch Update in October 2026 addressing this and many other vulnerabilities.
CVE-2026-91262 is a vulnerability in Oracle WebCenter Content 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Exploitation requires human interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on confidentiality and integrity but no impact on availability.