CVE-2026-87305 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is classified as a critical risk due to its potential for unauthenticated exploitation over network-accessible SMTP services. The core technical issue involves a mechanism that allows an attacker with remote network access to bypass authentication requirements and execute unauthorized actions within the application environment. Although the vulnerability is noted as difficult to exploit, which suggests complex prerequisites or specific environmental conditions are needed for successful execution, the severity of the outcome remains high because it leads directly to complete system compromise.
From a technical perspective, this flaw aligns with CWE-287, Improper Authentication, and potentially CWE-94, Code Injection, depending on the exact nature of the SMTP processing logic that is being abused. The vulnerability allows an unauthenticated actor to interact with the JD Edwards EnterpriseOne Tools interface via Simple Mail Transfer Protocol (SMTP). This indicates a failure in input validation or session management within the email-related services exposed by the application server. An attacker can craft specific malicious payloads sent through SMTP channels to trigger this flaw, effectively bypassing standard access controls that should restrict such interactions to authenticated users only.
The operational impact of successfully exploiting this vulnerability is severe, resulting in a complete takeover of the JD Edwards EnterpriseOne Tools environment. This level of compromise corresponds to high impacts across all three pillars of the CIA triad: Confidentiality, Integrity, and Availability. An attacker gaining control over these tools can access sensitive business data stored within the ERP system, modify critical configurations or financial records without detection, and disrupt operational continuity by rendering services unavailable. The CVSS 3.1 base score of 8.1 reflects this significant risk profile, driven primarily by the high impact scores for confidentiality, integrity, and availability despite a relatively high attack complexity rating.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques related to Initial Access via Email-based Malware or Exploitation of Remote Services. Specifically, it relates to T1566.002 Spearphishing Link if the SMTP vector is used for delivery, but more accurately fits T1190 Exploit Public-Facing Application given that the entry point is a network service exposed to potential attackers. The ability to achieve remote code execution or administrative control through an email protocol highlights the danger of exposing internal enterprise applications directly to untrusted networks without adequate perimeter security controls such as web application firewalls or strict access control lists.
Mitigation strategies must focus on immediate patching and defensive configuration changes. Oracle has released updates for versions 9.2.0.0 through 9.2.26.5 that address this specific flaw in the Enterprise Infrastructure SEC component. Organizations running these affected versions should apply the latest security patches provided by Oracle as a primary remediation step. In addition to patching, it is critical to ensure that SMTP services associated with JD Edwards are not directly exposed to the public internet. Network segmentation and firewall rules should restrict access to these services exclusively from trusted internal IP ranges or application servers that require legitimate interaction with the email subsystem.
Furthermore, implementing multi-factor authentication for all administrative interfaces and enforcing strict input validation on any external-facing endpoints can reduce the attack surface even if similar vulnerabilities exist in other components. Monitoring logs for anomalous SMTP traffic patterns, such as unusually large message sizes or malformed headers typical of exploitation attempts, can provide early detection indicators. Security teams should also review access control lists to ensure that no unnecessary services are enabled and that default credentials have been changed across the entire JD Edwards infrastructure. Regular vulnerability scanning focused on ERP-specific components will help identify similar misconfigurations before they can be leveraged by adversaries aiming for high-impact compromises of enterprise resource planning systems.