Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
72
CVE-2026-91299
Unauthenticated takeover in JD Edwards EnterpriseOne Orchestrator
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper access control in the E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator lets an unauthenticated attacker with network access over HTTP compromise the product. The flaw is easily exploitable and can lead to takeover of the Orchestrator, with impact that may extend to other products. Supported releases 9.2.0.0 through 9.2.26.5 are affected.
What to do: Apply Oracle's update for CVE-2026-91299. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Oracle JD Edwards EnterpriseOne Orchestrator | 9.2.0.0-9.2.26.5 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Weakness
- CWE-284
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H