CVE-2026-91299

Summary

A critical vulnerability exists in Oracle JD Edwards EnterpriseOne Orchestrator that allows unauthenticated attackers to fully compromise the system through HTTP requests. This affects versions 9.2.0.0 through 9.2.26.5 and can lead to complete takeover of the orchestrator component.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing attackers with network access to directly compromise the system through HTTP requests without any additional preconditions.

Blast radius

Successful exploitation could result in full compromise of JD Edwards EnterpriseOne Orchestrator and potentially impact additional related products due to the scope change in the vulnerability's impact.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation is required: Disable the E1 IOT Orchestrator Security component or restrict network access to the affected HTTP endpoints until a patch is available, as no fixed version has been published in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.