CVE-2026-87312 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is classified as a critical risk due to its potential for remote code execution and system compromise under specific conditions. The vulnerability allows an attacker with low privileges who possesses network access via the JDENET protocol to exploit the defect and gain unauthorized control over the affected software environment. Although the exploitation difficulty is rated as high, requiring significant technical skill or precise timing, the impact of a successful attack is severe, leading to complete takeover of the JD Edwards EnterpriseOne Tools infrastructure. This classification aligns with Common Vulnerability Scoring System version 3.1 base scores indicating substantial risk, specifically highlighting impacts on confidentiality, integrity, and availability.
From a technical perspective, this vulnerability represents an authentication bypass or privilege escalation flaw within the secure communication layer handled by the SEC component. The JDENET protocol serves as the primary interface for client-server interactions in Oracle JD Edwards environments, making it a high-value target for attackers seeking to infiltrate enterprise systems. The requirement for low-privileged access suggests that the attacker does not need administrative credentials initially but can leverage existing user accounts with minimal permissions to trigger the exploit. This characteristic is consistent with CWE identifiers such as CWE-287 Improper Authentication or CWE-269 Improper Privilege Management, where an actor exploits a weakness in identity verification or permission enforcement mechanisms. The network-based nature of the attack vector means that physical access is not required, and exploitation can occur over standard enterprise networks if JDENET ports are exposed to untrusted zones.
The operational impact of this vulnerability extends beyond simple data theft, encompassing full system compromise. A successful exploit enables an attacker to assume the identity of a legitimate user or potentially escalate privileges further within the application layer. This leads to unauthorized access to sensitive business data stored in JD Edwards databases, manipulation of financial records violating integrity constraints, and potential disruption of critical business operations by disabling services or corrupting configuration files. The CVSS vector components AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicate that while the attack complexity is high and requires low privileges, there are no user interaction requirements, and the scope remains unchanged but all three security triads are heavily impacted. This profile corresponds to ATT&CK techniques involving Initial Access via valid accounts and potentially Lateral Movement if the compromised instance serves as a pivot point for further network intrusion.
Mitigation strategies must focus on immediate patching and network segmentation due to the severity of the potential impact. Oracle has released updates addressing this flaw, and organizations running affected versions should apply the latest security patches immediately after validating compatibility with their specific deployment configurations. In addition to patching, implementing strict access controls for JDENET traffic is essential. Network administrators should ensure that JDENET ports are not exposed directly to untrusted networks such as the public internet or guest Wi-Fi segments. Instead, these connections should be restricted to trusted internal subnets using firewalls and intrusion detection systems configured to monitor for anomalous patterns associated with exploitation attempts. Furthermore, enforcing multi-factor authentication for all user accounts interacting with JD Edwards can mitigate the risk posed by low-privileged attackers who might otherwise leverage stolen credentials to initiate an attack chain leading to this vulnerability.