Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation and Full System Takeover
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a local privilege escalation flaw in JD Edwards EnterpriseOne Tools that allows an attacker with low privileges and a login to the infrastructure to compromise the tools. Successful exploitation can lead to full takeover of the JD Edwards EnterpriseOne Tools, resulting in complete loss of confidentiality, integrity and availability.

Affected Systems

Affected products are Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5. The issue resides in the Enterprise Infrastructure SEC component of the product.

Risk and Exploitability

The CVSS 3.1 base score is 7.8, indicating high severity, with an attack vector that requires local access, low attack complexity, low privileges, no user interaction, and unauthenticated scope. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The flaw is easily exploitable for users who can log on to the infrastructure, making the risk significant for organizations running the affected versions.

Generated by OpenCVE AI on October 21, 2026 at 07:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official security patch for JD Edwards EnterpriseOne Tools that addresses the local privilege escalation flaw.
  • Restrict user logon rights on the infrastructure hosting JD Edwards EnterpriseOne Tools to remove low‑privileged access where possible.
  • If a patch cannot be applied immediately, temporarily isolate JD Edwards EnterpriseOne Tools from the network to prevent potential takeover.

Generated by OpenCVE AI on October 21, 2026 at 07:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in JD Edwards EnterpriseOne Tools Allows Full Takeover
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T11:51:03.487Z

Reserved: 2026-09-08T21:49:12.411Z

Link: CVE-2026-87316

cve-icon Vulnrichment

Updated: 2026-10-28T11:50:02.176Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:08.967

Modified: 2026-10-28T12:17:49.457

Link: CVE-2026-87316

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:45:09Z

Weaknesses