CVE-2026-87326: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected product is Oracle JD Edwards EnterpriseOne Tools, specifically the Enterprise Infrastructure SEC component. Supported affected versions range from 9.2.0.0 through 9.2.26.5.
Does exploitation require an authenticated account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, and it does not require user interaction. Exploitation is described as difficult, indicating high attack complexity.
What is the potential impact of a successful attack?
A successful attack can result in unauthorized access to critical data or complete access to all data accessible through the affected JD Edwards EnterpriseOne Tools deployment. The stated impact is confidentiality only; integrity and availability impacts are not identified.