CVE-2026-87332: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - Cloud). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Exploitation requires a high-privileged attacker who already has logon access to the infrastructure where JD Edwards EnterpriseOne Tools runs. The attack is local and has high complexity, limiting exposure to environments where such infrastructure access and privileges have already been obtained.
Which versions are affected?
Supported Oracle JD Edwards EnterpriseOne Tools versions from 9.2.0.0 through 9.2.26.5 are affected.
What could a successful attacker do?
A successful attacker could perform unauthorized update, insert, or delete operations on some data accessible to JD Edwards EnterpriseOne Tools. They could also cause a partial denial of service affecting the product.