CVE-2026-87330: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The issue affects supported Oracle JD Edwards EnterpriseOne Tools versions from 9.2.0.0 through 9.2.26.5, specifically the E1 Dev Platform Tech - UNIX component. Exploitation requires a high-privileged attacker who can log on to the infrastructure where the product runs.
Can an unauthenticated remote attacker exploit this vulnerability?
No. The provided CVSS vector identifies the attack vector as local and requires high privileges; the attacker must already have a logon to the executing infrastructure. No user interaction is required once those prerequisites are met.
What could an attacker do after successful exploitation?
A successful attack can provide unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete access to some accessible data. It can also cause a partial denial of service affecting JD Edwards EnterpriseOne Tools.