CVE-2026-87325 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting supported versions ranging from 9.2.0.0 through 9.2.26.5. This security flaw is characterized by a complex exploitation path that requires an attacker to possess low-level privileges and network access via the JDENET protocol. The difficulty associated with exploiting this vulnerability suggests that it may involve intricate state manipulation or specific sequence requirements, which inherently limits its prevalence in automated attacks but does not negate the severity of potential consequences for targeted environments.
From a technical perspective, the core issue allows an authenticated attacker to manipulate internal processes leading to significant instability and data integrity violations. The primary operational impact manifests as a denial of service condition, where successful exploitation can cause the JD Edwards EnterpriseOne Tools application to hang or suffer from frequent, repeatable crashes that result in complete system unavailability. This aligns with CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition), indicating flaws in how resources are managed during specific request processing sequences. The availability impact is rated as high within the CVSS framework, reflecting the critical nature of maintaining uptime for enterprise resource planning systems.
Beyond service disruption, the vulnerability permits unauthorized modifications to accessible data, including update, insert, and delete operations. This represents a severe breach of integrity controls, corresponding to CWE-269 (Improper Privilege Management) or CWE-732 (Incorrect Permission Assignment for Critical Resource). An attacker leveraging this flaw could alter financial records, customer information, or operational parameters without proper authorization checks being enforced correctly during the specific interaction with the SEC component. This capability undermines the fundamental trust model of the ERP system and poses significant risks to business continuity and regulatory compliance.
Furthermore, the vulnerability grants unauthorized read access to a subset of data accessible by JD Edwards EnterpriseOne Tools. While this confidentiality impact is rated as low in the CVSS scoring due to the limited scope of exposed data, it still constitutes a breach of CWE-200 (Information Exposure). Attackers could potentially extract sensitive business intelligence or personal identifiable information that was not intended for their privilege level. The combination of these impacts results in a CVSS 3.1 Base Score of 6.4, categorized as Medium severity, with the vector indicating network accessibility, high attack complexity, low required privileges, and no user interaction requirements.
In terms of threat modeling, this vulnerability can be mapped to MITRE ATT&CK techniques involving exploitation for denial of service and potential lateral movement or data exfiltration if combined with other weaknesses. Specifically, it relates to T1499 (Endpoint Denial of Service) and potentially T1078 (Valid Accounts) given the requirement for low-privileged access. The reliance on JDENET highlights that network segmentation and strict firewall rules are critical defense layers, as the attack surface is exposed over the network rather than requiring local physical or remote desktop access.
Mitigation strategies should prioritize immediate patching to the latest supported version of Oracle JD Edwards EnterpriseOne Tools where this issue has been resolved by vendor engineering. In environments where patching cannot be applied immediately due to operational constraints, defensive measures must focus on restricting network access to the JDENET port exclusively from trusted subnets and application servers. Implementing strict input validation at the perimeter firewall or web application firewall can help mitigate attempts to trigger the specific sequences required for exploitation. Additionally, monitoring system logs for unusual patterns of crashes or repeated connection failures may aid in early detection of attempted exploits. Regular audits of user privileges are also recommended to ensure that low-privileged accounts do not possess unnecessary access rights that could be leveraged if this vulnerability is successfully exploited.