CVE-2026-87381: Infoleak
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, specifically the Business Logic Infra SEC component.
What does an attacker need to exploit this issue?
An attacker needs network access to JDENET and low-privileged access. No user interaction is required, and the vulnerability is described as easily exploitable.
What could a successful attack allow?
A successful attack can allow unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete operations on some accessible data. The stated impact is limited to confidentiality and integrity; no availability impact is listed.