CVE-2026-87328: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Oracle JD Edwards EnterpriseOne Tools deployments using the Enterprise Infrastructure SEC component are affected if they are on supported versions from 9.2.0.0 through 9.2.26.5 and are reachable over JDENET.
Does exploitation require credentials or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via JDENET, and it does not require user interaction. Exploitation is rated difficult, indicating high attack complexity.
What is the potential impact of a successful attack?
A successful attack can provide unauthorized access to critical data or complete access to all accessible JD Edwards EnterpriseOne Tools data. The stated impact is confidentiality only; integrity and availability impacts are not identified.