Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Published: 2026-10-20
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Disclosure and Partial Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in Oracle JD Edwards EnterpriseOne Tools, specifically the Interoperability SEC component, allows a low‑privileged attacker with network access via HTTP to compromise the tool, resulting in unauthorized access to all data that JD Edwards EnterpriseOne Tools exposes and triggering a partial denial of service. The impact is high confidentiality loss and partial availability loss, reflected in a CVSS base score of 7.1.

Affected Systems

Oracle Corporation JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are impacted by this issue. The vulnerability resides in the Interoperability SEC component of the JD Edwards EnterpriseOne Tools suite.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. Exploitation is likely possible over standard HTTP traffic, requiring only low privileges. The EPSS score of < 1% indicates a very low but nonzero exploit probability, and the vulnerability is not listed in the CISA KEV catalog. No public exploits are known, and although the likelihood is low, the high confidentiality and partial availability impact still pose significant risk.

Generated by OpenCVE AI on October 28, 2026 at 01:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for JD Edwards EnterpriseOne Tools affected versions 9.2.0.0‑9.2.26.5
  • Restrict network access to JD Edwards EnterpriseOne Tools by configuring firewall rules or network segmentation to allow only trusted IP addresses
  • Disable or lock down the Interoperability SEC component if it is not required, and enforce strict authentication and role‑based access control

Generated by OpenCVE AI on October 28, 2026 at 01:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Attack Enables Data Exposure and Partial DoS in JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Leads to Unauthorized Data Access and Partial Denial of Service in Oracle JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Leads to Unauthorized Data Access and Partial Denial of Service in Oracle JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T19:52:28.583Z

Reserved: 2026-09-08T21:49:12.410Z

Link: CVE-2026-87307

cve-icon Vulnrichment

Updated: 2026-10-27T19:52:17.330Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:07.927

Modified: 2026-10-27T20:17:16.560

Link: CVE-2026-87307

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor