CVE-2026-87386 in JD Edwards EnterpriseOne General Ledger
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne General Ledger. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the E1 Foundation component of Oracle JD Edwards EnterpriseOne General Ledger, specifically affecting version 9.2. This security flaw is characterized by a condition that leads to service unavailability rather than data compromise or privilege escalation. The nature of this defect classifies it as an availability-focused issue where the primary consequence is the disruption of normal operational functions within the financial management system. While the vulnerability allows for remote exploitation, the complexity involved in triggering the fault significantly limits its practical utility for attackers who lack deep knowledge of the internal state and network conditions required to induce the failure condition.
From a technical perspective, the flaw enables an attacker with low privileges and valid JDENET access to cause the application to hang or crash repeatedly. This behavior indicates that the underlying code fails to properly handle specific inputs or states during processing within the General Ledger module. When these malformed or specifically crafted requests are processed by the server, they trigger a state where the application becomes unresponsive or terminates unexpectedly. The requirement for network access via JDENET suggests that the vulnerability is exposed through standard communication channels used by clients to interact with the enterprise resource planning system, making it accessible over internal networks or potentially external interfaces if not properly segmented and secured.
The operational impact of this vulnerability centers on denial of service conditions. Successful exploitation results in a complete halt of the JD Edwards EnterpriseOne General Ledger services for affected users. This disruption can prevent critical financial operations such as posting transactions, generating reports, or performing month-end closings from proceeding until the system is restarted or recovered. For organizations relying on continuous availability of their ERP systems to manage daily business activities, even intermittent crashes caused by this vulnerability can lead to significant productivity losses and operational inefficiencies. The CVSS 3.1 base score of 5.3 reflects a medium severity rating primarily due to the high complexity required for exploitation and the low privilege level needed, balanced against the severe impact on availability.
In terms of industry standard classifications, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption or potentially CWE-20 Improper Input Validation depending on whether the crash is caused by resource exhaustion from malformed data or a logic error triggered by specific input sequences. The attack vector corresponds to MITRE ATT&CK techniques related to Service Stop or Denial of Service, where an adversary aims to disrupt services rather than exfiltrate data. Given that the exploit requires low privileges and high complexity, it is less likely to be targeted in widespread automated attacks but remains a risk for insider threats or attackers with limited access who seek to cause disruption within the organization's financial infrastructure.
Mitigation strategies should focus on both technical controls and administrative policies. Oracle has released patches addressing this issue which must be applied promptly to affected systems running version 9.2 of JD Edwards EnterpriseOne General Ledger. In addition to patching, organizations should enforce strict network segmentation to limit access to the JDENET interface only from authorized client IP addresses. Implementing web application firewalls or intrusion prevention systems can help detect and block anomalous traffic patterns that may indicate attempts to exploit this vulnerability. Furthermore, monitoring tools should be configured to alert on unusual spikes in error logs or service restarts within the General Ledger component, allowing for rapid detection of exploitation attempts before they cause prolonged outages.