CVE-2026-87317 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is characterized by a complex exploitation vector that requires an unauthenticated attacker to possess network access via the Simple Mail Transfer Protocol (SMTP). The difficulty associated with exploiting this vulnerability suggests that while it presents a tangible risk, successful exploitation demands specific conditions or sophisticated techniques beyond simple automated scanning tools. Despite the high complexity required for execution, the potential consequences of a successful attack are significant, impacting both data integrity and system availability within the JD Edwards EnterpriseOne environment.
From a technical perspective, the flaw allows an attacker to manipulate accessible data through unauthorized update, insert, or delete operations. This capability directly compromises the confidentiality and integrity principles of information security by allowing external actors to alter critical business records without proper authentication or authorization checks. Furthermore, the vulnerability enables partial denial of service conditions, which disrupts normal operational workflows and degrades system performance for legitimate users. The combination of data manipulation capabilities and resource exhaustion potential creates a multifaceted threat landscape where an attacker can not only corrupt data but also hinder organizational productivity by rendering parts of the application inaccessible or unstable under load generated by malicious activity.
The impact assessment aligns with a CVSS 3.1 Base Score of 4.8, classified as Medium severity due to its localized scope and high complexity requirements. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) indicates that the attack is network-based but requires high access complexity and no user interaction or privileges for initiation, while resulting in low integrity and availability impacts with no direct confidentiality breach according to this specific scoring model. In terms of industry standards, this vulnerability maps closely to CWE-94 Improper Control of Generation of Code (Code Injection) if the data manipulation involves executable logic, or more likely CWE-798 Use of Hard-coded Credentials if authentication bypass is involved in the SMTP handling process. Additionally, it relates to CWE-20 Improper Input Validation regarding how the system processes incoming mail-related requests. From an offensive security framework perspective, this activity corresponds to ATT&CK technique T1496 Resource Hijacking for denial-of-service aspects and potentially T1537 Transfer Data to Cloud Account if data exfiltration is implied by unauthorized access, though primarily it reflects lateral movement or direct system compromise via service exploitation.
Mitigation strategies must prioritize immediate patching of the JD Edwards EnterpriseOne Tools product to a version beyond 9.2.26.5 where this vulnerability has been remediated. In environments where upgrading is not immediately feasible, organizations should implement strict network segmentation policies to restrict SMTP traffic from untrusted networks or external sources directly to the affected servers. Deploying intrusion detection and prevention systems with signatures capable of identifying anomalous SMTP payloads targeting JD Edwards infrastructure can provide an additional layer of defense. Furthermore, enforcing rigorous input validation on all mail-handling components and applying principle of least privilege to service accounts associated with the Enterprise Infrastructure SEC component will reduce the attack surface. Regular security audits and penetration testing focused on email interface vulnerabilities are recommended to ensure that similar weaknesses do not persist in other integrated systems within the enterprise architecture.