CVE-2026-87318 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw represents a significant risk to organizations relying on this enterprise resource planning platform for critical business operations. The nature of the vulnerability is characterized by its difficulty to exploit and its requirement for low-privileged attacker access with valid logon credentials to the infrastructure hosting the JD Edwards EnterpriseOne Tools environment. Despite the high complexity required to leverage this flaw, the potential impact upon successful exploitation is severe, targeting both the confidentiality and integrity of data managed within the system while leaving availability largely unaffected according to standard scoring metrics.
From a technical perspective, the vulnerability allows an authenticated attacker with low-level privileges to compromise the underlying JD Edwards EnterpriseOne Tools infrastructure. The core issue likely stems from insufficient access control checks or improper validation mechanisms within the SEC component, which serves as a foundational security layer for the application suite. When exploited, this flaw enables the attacker to bypass intended restrictions on data manipulation and retrieval operations. This capability effectively elevates the threat landscape from simple unauthorized viewing to active modification of critical business records. The ability to create, delete, or modify access controls indicates that the vulnerability may involve privilege escalation vectors or logic flaws in how user permissions are enforced during specific administrative or operational tasks within the application layer.
The operational impact of this vulnerability is substantial for any organization utilizing JD Edwards EnterpriseOne. Successful exploitation results in unauthorized creation, deletion, or modification of critical data stored within the system. This directly compromises the integrity of business records, which can lead to financial discrepancies, regulatory non-compliance, and loss of trust among stakeholders. Furthermore, the attacker gains unauthorized access to sensitive information that was previously restricted by role-based access controls. In worst-case scenarios, this extends to complete access to all data accessible through JD Edwards EnterpriseOne Tools, exposing proprietary business intelligence, customer personal information, and financial records to potential exfiltration or malicious alteration. The CVSS 3.1 base score of 6.3 reflects a medium severity rating driven primarily by the high impact on confidentiality and integrity, despite the low attack vector requiring local access and high complexity.
In terms of industry standard classifications, this vulnerability aligns with CWE-20 Improper Input Validation or CWE-862 Missing Authorization, depending on whether the root cause is related to malformed data processing or insufficient permission checks during resource access. The requirement for an attacker to have logon access places this within the scope of internal threats rather than external network-based attacks. In the context of the MITRE ATT&CK framework, this activity corresponds to techniques involving Account Manipulation and Data Staged or Exfiltration over C2 channels if data is removed, as well as Defense Evasion through permission modification. The vector AV:L indicates local access, AC:H denotes high complexity requiring specific conditions, PR:L signifies low privileges are sufficient for the initial foothold, UI:N means no user interaction is required beyond authentication, S:U shows no scope change to other systems, while C:H and I:H confirm high impacts on confidentiality and integrity.
Mitigation strategies must focus on immediate patching and enhanced monitoring. Organizations should apply the latest security patches provided by Oracle for JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 as soon as they are available in their respective update streams. Until patches are applied, it is critical to enforce strict least-privilege principles across all user accounts interacting with the infrastructure. Administrators should review and audit existing permissions for low-privileged users who have logon access to the JD Edwards servers, ensuring that only essential services require elevated rights where possible. Implementing robust logging and monitoring solutions can help detect anomalous activities such as unusual data modification patterns or unauthorized access attempts to critical datasets. Additionally, network segmentation strategies should be reviewed to ensure that even if an attacker gains low-privileged shell access on the application server, lateral movement to other sensitive systems is restricted by firewall rules and internal security groups. Regular vulnerability assessments focused on enterprise applications are recommended to identify similar misconfigurations or unpatched components across the IT estate.