CVE-2026-87312: High severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Does an attacker need valid access or user interaction to exploit this issue?
The attacker needs low-privileged access and network access through JDENET. No user interaction is required, and exploitation is described as difficult.
Which supported releases are affected?
Affected supported releases are Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5.
What could an attacker achieve after successful exploitation?
A successful attack can result in takeover of JD Edwards EnterpriseOne Tools, with high impacts to confidentiality, integrity, and availability.