External risk intelligence

Oracle JD Edwards EnterpriseOne Tools Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-91265

The vulnerability affects JD Edwards EnterpriseOne Tools, an enterprise resource planning system. While it is accessible via HTTP, these systems are typically deployed within internal corporate networks or private environments to support business operations, making public internet exposure uncommon despite being technically reachable via network protocols.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts Oracle's JD Edwards EnterpriseOne Tools, a business software system. The issue could allow unauthorized access and modification of critical business data. The primary concern is to confirm if this specific software is in use and if it is exposed in a way that aligns with the threat's characteristics.

Unauthenticated access to business data.
Confirms usage and exposure of business software.
Assess relevance to our critical business systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request over the network to a vulnerable JD Edwards EnterpriseOne Tools system. This could allow them to gain unauthorized access to or modify critical data.

No authentication required.
Network access via HTTP.
Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could modify or delete critical data within JD Edwards EnterpriseOne Tools, or gain complete access to all data accessible by the system. This could occur when the system is exposed to the network via HTTP.

Critical system data.
Network access via HTTP.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in JD Edwards EnterpriseOne Tools, accessible via HTTP, likely impacts business application owners and the infrastructure teams supporting them. The immediate priority is to identify all instances of the affected technology, confirm their reachability and criticality, and then assign ownership for a planned remediation.

Application and infrastructure teams own remediation.
Verify system reachability and business criticality.
Plan remediation based on risk and data impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle JD Edwards EnterpriseOne Tools?

It is a core component of the JD Edwards EnterpriseOne platform, which is an integrated enterprise resource planning (ERP) software suite. Organizations use this suite to manage essential business functions like finance, supply chain, and human resources. The Tools component specifically provides the underlying infrastructure and services required to run these business applications, acting as the foundation that enables users to interact with critical corporate data.

What does CVE-2026-91265 mean for system security?

This vulnerability represents a significant security weakness that allows an unauthorized party to bypass authentication mechanisms. By exploiting this flaw, an attacker can gain the same level of data access as a legitimate user. This means they could potentially view, change, or delete sensitive business information managed by the software, compromising both the confidentiality and the integrity of the data stored within the system.

How can an attacker trigger this vulnerability?

An attacker triggers this bug by sending a specially crafted request over a network connection using the HTTP protocol. Because the vulnerability does not require any prior authentication, no login credentials or user sessions are needed to execute the attack. It is important to note that internal system activity or traffic that does not utilize these specific HTTP-based request paths is generally not the focus of this particular flaw.

Why should I care about this vulnerability based on Halo Surface Signal?

While the vulnerability is technically reachable via HTTP, Halo Surface Signal notes that JD Edwards EnterpriseOne Tools are typically deployed within private, internal corporate networks. This means that even though the bug is capable of being triggered over a network, its real-world relevance depends heavily on your specific deployment configuration. Systems isolated from the public internet have a reduced risk compared to those directly exposed to broader network environments.

What are the first steps to address CVE-2026-91265?

Begin by identifying all servers in your environment running the affected versions of JD Edwards EnterpriseOne Tools. Once identified, evaluate the network accessibility of these instances to determine if they are exposed to untrusted networks. Coordinate with your application and infrastructure teams to verify the business criticality of these systems and prepare a remediation plan to update the software, prioritizing instances that are most accessible and handle the most sensitive data.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.