CVE-2026-87384 in JD Edwards EnterpriseOne Human Resources Management
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the JD Edwards EnterpriseOne Human Resources Management product, specifically affecting version 9.2 of Oracle JD Edwards. This security flaw is located in the core components responsible for handling human resources data and operations. The nature of this defect allows an attacker with low privileges to exploit a weakness through network access via the JDENET protocol. JDENET serves as the primary communication layer for client-server interactions within the JD Edwards architecture, making it a critical attack surface. Because the vulnerability is easily exploitable and does not require user interaction or complex preconditions, it presents a significant risk to organizations relying on this enterprise resource planning system for their human capital management processes.
From a technical perspective, the flaw enables unauthorized modifications to data integrity and availability within the Human Resources module. Specifically, an attacker can perform unauthorized updates, insertions, or deletions of accessible HR data. This capability directly compromises the confidentiality and integrity of sensitive employee records, payroll information, and organizational structures stored within the system. Furthermore, the vulnerability allows for a partial denial of service condition, meaning that successful exploitation can disrupt normal operations by rendering certain functionalities unavailable to legitimate users. The operational impact is twofold: first, the potential for data tampering poses severe compliance and reputational risks due to the sensitive nature of HR data; second, the availability impact hinders business continuity by interrupting access to critical human resources functions.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 5.4, indicating a medium level of risk. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) highlights that the attack vector is network-based with low complexity and requires only low privileges to execute. Notably, there are no impacts on confidentiality according to this specific score, but both integrity and availability suffer low-level impacts. This classification aligns with common weakness enumerations such as CWE-269 for Improper Privilege Management or CWE-732 for Incorrect Permission Assignment for Critical Resource, depending on the exact mechanism of privilege escalation or access control bypass involved in the JDENET processing logic. In terms of adversary tactics, this vulnerability maps to MITRE ATT&CK techniques related to Initial Access and potentially Impact categories such as Data Manipulation or Service Disruption, reflecting how an attacker might leverage weak authentication or authorization checks to gain foothold and disrupt services.
To mitigate these risks, organizations running JD Edwards EnterpriseOne version 9.2 should immediately apply the latest security patches provided by Oracle for this specific component. It is crucial to verify that all relevant hotfixes related to HR management and JDENET protocol handling are installed. Additionally, network segmentation strategies should be reviewed to ensure that access to JDENET ports is restricted to authorized IP ranges only, reducing the attack surface exposed to potential low-privileged attackers. Implementing strict input validation on server-side handlers for HR data operations can also help prevent unauthorized insertions or deletions even if an attacker gains initial access. Regular audits of user privileges within the Human Resources module are recommended to ensure that no accounts possess excessive permissions beyond their job requirements, thereby limiting the potential blast radius of any successful exploitation attempt.