CVE-2026-87315: High severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle JD Edwards EnterpriseOne Tools supported versions 9.2.0.0 through 9.2.26.5 are affected, specifically the Enterprise Infrastructure SEC component.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker with network access via HTTP can exploit the issue, and no user interaction is required.
What could an attacker do after successful exploitation?
Successful exploitation can allow unauthorized creation, deletion, or modification of critical data or all data accessible to JD Edwards EnterpriseOne Tools. The reported impact is integrity-only; no confidentiality or availability impact is specified.