CVE-2026-87321: Medium severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle JD Edwards EnterpriseOne Tools deployments using supported versions 9.2.0.0 through 9.2.26.5 are affected. The vulnerable component is Package Build SEC.
What level of access does an attacker need?
An attacker must already have high privileges and be able to log on to the infrastructure where JD Edwards EnterpriseOne Tools runs. The issue is local and does not require user interaction, but exploitation is described as difficult.
What could happen if the vulnerability is exploited?
Successful exploitation can result in takeover of JD Edwards EnterpriseOne Tools, with high confidentiality, integrity, and availability impact.