Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Takeover of JD Edwards EnterpriseOne Tools
Action: Assess Impact
AI Analysis

Impact

A locally exploitable flaw in the JD Edwards EnterpriseOne Tools product allows a low‑privileged user who can log onto the host to compromise the application after a user performs a required action. Successful exploitation can lead to full control over the JD Edwards EnterpriseOne Tools installation, jeopardizing confidentiality, integrity, and availability of the data processed by the tools.

Affected Systems

Oracle Corporation’s JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, are affected by this vulnerability.

Risk and Exploitability

The flaw scores a 6.7 on CVSS 3.1, reflecting a high impact when exploited. EPSS data is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must have local access to the host running JD Edwards EnterpriseOne Tools, possess low‑level privileges, and a human interaction is required to complete the attack. Because the exploit is difficult and requires user cooperation, the likelihood of widespread compromise is reduced; however, the potential damage remains significant if successful.

Generated by OpenCVE AI on October 22, 2026 at 01:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s October 2026 CPU advisory for any vendor‑supplied patches or upgrades and apply them as soon as they become available
  • Limit local login access to the JD Edwards EnterpriseOne Tools host to accounts that have no higher privileges; enforce strict least‑privilege policies and deny interactive access to untrusted users
  • Enable comprehensive audit logging on the JD Edwards EnterpriseOne Tools installation and monitor for abnormal local user activity or configuration changes

Generated by OpenCVE AI on October 22, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation Allows Takeover of JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T11:59:26.608Z

Reserved: 2026-09-08T21:49:12.411Z

Link: CVE-2026-87320

cve-icon Vulnrichment

Updated: 2026-10-28T11:58:56.773Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:09.427

Modified: 2026-10-28T12:17:52.260

Link: CVE-2026-87320

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:30:12Z

Weaknesses