CVE-2026-87389 in JD Edwards EnterpriseOne Human Resources Management
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the JD Edwards EnterpriseOne Human Resources Management product, specifically affecting version 9.2 of Oracle JD Edwards. This security flaw is categorized as a difficult-to-exploit issue that permits unauthenticated attackers to compromise the integrity of the application's data through network access via HTTP. The core technical nature of this weakness involves an improper restriction on data modification operations within the Human Resources module, allowing external entities to perform unauthorized updates, inserts, or deletes against accessible records without valid authentication credentials. This represents a significant failure in access control mechanisms where the system fails to properly verify user identity before permitting state-changing actions on sensitive human resources information.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, and more specifically relates to CWE-862, Missing Authorization. The attacker leverages network connectivity over HTTP to send crafted requests that bypass standard authentication checks. Because the vector is classified as Network (AV:N) and requires no user interaction or privileges (PR:N/UI:N), the attack surface is broad despite the high complexity required for exploitation (AC:H). This suggests that while automated tools might attempt such attacks, successful execution likely depends on specific environmental configurations, timing, or unique application states that make the exploit path viable. The absence of authentication requirements means any entity with network reachability to the JD Edwards server can theoretically target this endpoint, although the high complexity acts as a natural deterrent against widespread automated scanning and exploitation attempts.
The operational impact of this vulnerability is primarily focused on data integrity rather than confidentiality or availability, as indicated by the CVSS 3.1 base score of 3.7 with an Integrity impact level of Low (I:L). Successful exploitation allows an attacker to alter employee records, modify payroll information, change benefit enrollments, or delete critical HR data without detection through standard audit logs if logging is not sufficiently robust. This can lead to significant organizational disruption including incorrect payroll processing, compromised employee privacy due to altered personal details, and potential legal liabilities arising from inaccurate human resources documentation. While the immediate risk of full system compromise is low compared to remote code execution flaws, the erosion of trust in HR data integrity poses a substantial long-term business risk for organizations relying on JD Edwards for workforce management.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this case it exploits the lack thereof by bypassing authentication entirely, which also touches upon T1136, Create Account, if an attacker were able to create new unauthorized users through the insert functionality. The attack vector is consistent with web application attacks where input validation and access control checks are insufficiently enforced on API endpoints or internal service interfaces exposed via HTTP. Organizations must recognize that even low-severity vulnerabilities can be chained with other weaknesses to achieve higher impact, making this a critical component of their overall security posture assessment.
Mitigation strategies should prioritize immediate patching by applying the latest Oracle JD Edwards EnterpriseOne updates released after the disclosure of this vulnerability. Since authentication is bypassed via HTTP, ensuring that all administrative and sensitive interfaces are not directly exposed to untrusted networks through firewalls or web application firewalls (WAF) can reduce exposure. Implementing strict input validation on all data modification endpoints and enforcing role-based access control checks at every layer of the application stack will help prevent unauthorized modifications. Additionally, enabling comprehensive audit logging for all HR-related transactions allows for rapid detection of any anomalous activity resulting from exploitation attempts. Regular security assessments and penetration testing focused on authentication bypasses are recommended to identify similar weaknesses in other modules before they can be exploited by malicious actors.