CVE-2026-87309 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for critical business operations. The core issue stems from insufficient validation or access control mechanisms within the package build process, which allows an attacker with low privileges and network access via HTTP to exploit the system. Unlike vulnerabilities that require high-level administrative rights or complex user interaction, this flaw can be leveraged by a relatively unprivileged actor who merely needs connectivity to the affected service over standard web protocols. This lowers the barrier for entry significantly, as it does not require social engineering or physical proximity, making remote exploitation via HTTP a viable attack vector for malicious actors targeting these specific software versions.
From a technical perspective, the vulnerability enables unauthorized creation, deletion, or modification of critical data within the JD Edwards EnterpriseOne Tools environment. This capability directly compromises the integrity of the system by allowing an attacker to alter essential configurations, user permissions, or business logic components that are fundamental to the application's operation. Furthermore, the flaw impacts availability by enabling a low-privileged attacker to cause hangs or frequently repeatable crashes, resulting in a complete denial of service condition for JD Edwards EnterpriseOne Tools. The combination of these effects means that an adversary can not only corrupt data integrity but also disrupt business continuity by rendering the system inaccessible to legitimate users. This dual impact on both integrity and availability is characteristic of severe vulnerabilities where input handling or session management fails to properly restrict actions based on user privilege levels, leading to state manipulation and resource exhaustion.
The operational impact of this vulnerability extends beyond immediate technical disruption to include potential long-term business risks. Unauthorized modification of critical data can lead to financial discrepancies, incorrect reporting, and compromised audit trails within the enterprise environment. The ability to cause denial of service disrupts daily operations, potentially causing significant downtime costs and loss of productivity for employees dependent on the JD Edwards platform. Given that the attack vector is network-based via HTTP, this vulnerability could be exploited remotely over the internet if the affected services are exposed without adequate perimeter security controls such as web application firewalls or strict access control lists. The CVSS 3.1 base score of 8.1 reflects the high severity due to the significant integrity and availability impacts, despite requiring low privileges for exploitation. This scoring indicates that while initial access is restricted, the consequences of successful exploitation are severe enough to warrant immediate attention and remediation efforts across all affected deployments.
To mitigate this vulnerability, organizations must prioritize patching JD Edwards EnterpriseOne Tools to a version later than 9.2.26.5 where these issues have been addressed by Oracle. In environments where immediate patching is not feasible due to operational constraints or testing requirements, temporary mitigations should be implemented to reduce the attack surface. This includes restricting network access to the affected HTTP endpoints through firewall rules that limit connectivity to trusted IP addresses only and ensuring that no low-privileged accounts are granted unnecessary permissions within the Package Build SEC component. Additionally, deploying intrusion detection systems configured to detect patterns associated with package build exploitation attempts can provide an additional layer of defense. Regular security assessments and vulnerability scans should be conducted to identify any unpatched instances across the enterprise infrastructure.
This vulnerability aligns with CWE-269 Improper Privilege Management, as it allows a lower privileged user to perform actions that should require higher privileges or no access at all. It also relates to CWE-787 Out-of-bounds Write if the crash mechanism involves memory corruption, though the description emphasizes denial of service and data modification more broadly. From an ATT&CK perspective, this vulnerability facilitates techniques such as T1068 Exploitation for Privilege Escalation or T1499 Endpoint Denial of Service depending on how the attacker leverages the flaw to cause crashes. The ability to modify critical data also touches upon T1565 Data Manipulation, where an adversary alters stored information to influence operational outcomes. Understanding these mappings helps in categorizing the threat within broader security frameworks and ensures that defensive strategies address not just the specific technical flaw but its potential use in larger attack chains aimed at compromising enterprise systems.