Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle JD Edwards EnterpriseOne Tools allows an unauthenticated attacker with network access via HTTP to create, delete, or modify critical data. The vulnerability is located in the Enterprise Infrastructure SEC component and is a weak authentication/authorization flaw (CWE-284). It is described as easily exploitable, directly compromising the integrity of the system's data while leaving confidentiality and availability unaffected.

Affected Systems

The impacted products are Oracle JD Edwards EnterpriseOne Tools, specifically versions 9.2.0.0 through 9.2.26.5. Organizations should verify whether their deployments fall within this version range and assess exposure of the Enterprise Infrastructure SEC component.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 reflects a high integrity impact. The EPSS score of less than 1% indicates a very low probability of exploitation in the short term, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely over HTTP without authentication, so the risk remains moderate to high for environments that expose this interface to the network.

Generated by OpenCVE AI on October 28, 2026 at 15:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle security patch that addresses the unauthenticated HTTP access issue in JD Edwards EnterpriseOne Tools.
  • Restrict inbound HTTP traffic to the JD Edwards environment using firewall rules or network segmentation, allowing connections only from trusted hosts or a VPN.
  • If a patch is not yet available, disable or restrict the insecure HTTP interface or isolate the affected system from the network until a fix is deployed.

Generated by OpenCVE AI on October 28, 2026 at 15:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Unauthorized Data Modification in Oracle JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T11:42:07.347Z

Reserved: 2026-09-08T21:49:12.410Z

Link: CVE-2026-87315

cve-icon Vulnrichment

Updated: 2026-10-28T11:41:43.949Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:08.850

Modified: 2026-10-28T12:17:48.490

Link: CVE-2026-87315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T15:15:14Z

Weaknesses