Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Oracle JD Edwards Orchestrator can be taken over remotely

CVE-2026-91276 · published 15 days ago
Summary

The JD Edwards EnterpriseOne Orchestrator (versions 9.2.0.0 through 9.2.26.5) can be accessed by someone on the network without a login, if a user clicks a crafted link. This could let the attacker view or change important business data. Apply the latest security updates and restrict network access to the Orchestrator to only trusted systems, and educate users not to open unexpected links.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle corporation jd edwards enterpriseone orchestrator <= 9.2.26.5
Original advisory text
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Diffic...
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published20 Oct 2026
Updated3 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-91276 · NVD
CVE-2026-91276 · MITRE
Track software like this
Free during beta