CVE-2026-87325: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Organizations using Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. Exploitation requires network access to the JDENET service and an existing low-privileged account.
Does exploitation require user interaction or elevated privileges?
No user interaction is required, and the attacker does not need elevated privileges. However, the attacker must already have low-privileged access and be able to reach JDENET over the network.
What could indicate successful exploitation?
Potential signs include unexplained hangs or recurring crashes of JD Edwards EnterpriseOne Tools, including complete denial of service. The issue may also result in unauthorized changes, additions, deletions, or reads involving a subset of data accessible to the product.
What is the most relevant temporary mitigation if updates cannot be applied immediately?
Limit network access to JDENET to only trusted, authorized systems and accounts. Because exploitation requires low-privileged access, review and restrict low-privileged accounts that can reach the affected service.