Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Vulnerability in JD Edwards EnterpriseOne Tools, specifically the Enterprise Infrastructure SEC component, permits an unauthenticated attacker with SMTP network access to compromise the application. The flaw is difficult to exploit yet, when successful, can lead to complete takeover, impacting confidentiality, integrity, and availability. The weakness is identified with CWE-284.

Affected Systems

Affected versions are Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5. The vulnerability exists across all installations of these version numbers that rely on the Enterprise Infrastructure SEC component.

Risk and Exploitability

The CVSS v3.1 score is 8.1, indicating high severity. Exploitation requires no privilege or user interaction and occurs over a network channel. The EPSS score is < 1%, implying a low probability of exploitation despite high impact. The vulnerability is not listed in CISA’s KEV catalog, so no publicly catalogued exploits are known.

Generated by OpenCVE AI on October 28, 2026 at 01:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a version later than 9.2.26.5.
  • Restrict SMTP inbound traffic to trusted sources and enable authentication.
  • Continuously monitor SMTP logs and application audit trails for suspicious activity.

Generated by OpenCVE AI on October 28, 2026 at 01:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated SMTP Remote Code Execution in JD Edwards EnterpriseOne Tools
Weaknesses CWE-94

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated SMTP Remote Code Execution in JD Edwards EnterpriseOne Tools
Weaknesses CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T19:28:08.876Z

Reserved: 2026-09-08T21:49:12.410Z

Link: CVE-2026-87305

cve-icon Vulnrichment

Updated: 2026-10-27T19:27:39.918Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:07.680

Modified: 2026-10-27T20:17:16.290

Link: CVE-2026-87305

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses