Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-10-20
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and access leading to confidentiality and integrity compromise
Action: Patch Immediately
AI Analysis

Impact

A local low‑privileged user can exploit a flaw in Enterprise Infrastructure SEC of JD Edwards EnterpriseOne Tools to create, delete, or modify access permissions and critical data. The vulnerability permits unauthorized data modification and unauthorized access, resulting in high confidentiality and integrity impact.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected.

Risk and Exploitability

The CVSS base score is 6.3 with local access required; exploitation needs a low-privileged user logged into the infrastructure where the tools run. The EPSS score indicates a very low exploitation probability (< 1%), and the vulnerability is not listed in KEV. Once exploited, an attacker can alter or delete critical data on the affected servers.

Generated by OpenCVE AI on October 28, 2026 at 17:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade beyond version 9.2.26.5.
  • Enforce least‑privilege by limiting local user rights to the minimum required on JD Edwards servers.
  • Segment the network and remove unnecessary services to reduce exposure.

Generated by OpenCVE AI on October 28, 2026 at 17:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing Unauthorized Data Modification in Oracle JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing Unauthorized Data Modification in JD Edwards EnterpriseOne Tools
Weaknesses CWE-284
CWE-285

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allowing Unauthorized Data Modification in JD Edwards EnterpriseOne Tools
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T13:21:36.036Z

Reserved: 2026-09-08T21:49:12.411Z

Link: CVE-2026-87319

cve-icon Vulnrichment

Updated: 2026-10-28T13:21:20.059Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:09.313

Modified: 2026-10-28T14:17:05.553

Link: CVE-2026-87319

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T17:45:02Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor