Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Takeover of JD Edwards EnterpriseOne Tools via local high-privileged attacker
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists within the JD Edwards EnterpriseOne Tools component called Package Build SEC. An attacker who already has high privileged access on the infrastructure where JD Edwards EnterpriseOne Tools runs can exploit this weakness and take complete control of the tools, leading to full confidentiality, integrity and availability compromise.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected.

Risk and Exploitability

The CVSS 3.1 score of 6.4 indicates a moderate severity risk. Exploitation requires local high privileged access and is considered difficult, with no EPSS reported. The vulnerability is not listed in the CISA KEV catalog, but it remains a significant concern for systems that have not applied any vendor fix.

Generated by OpenCVE AI on October 21, 2026 at 07:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Oracle JD Edwards EnterpriseOne Tools to a patched release that excludes versions 9.2.0.0 to 9.2.26.5.
  • Limit local high‑privileged account activity on servers running JD Edwards EnterpriseOne Tools and enforce least‑privilege principles.
  • Monitor system logs for anomalous activity that could indicate an exploitation attempt.

Generated by OpenCVE AI on October 21, 2026 at 07:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title High Privileged Local Attack Enables Takeover of JD Edwards EnterpriseOne Tools
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T12:05:26.115Z

Reserved: 2026-09-08T21:49:12.411Z

Link: CVE-2026-87321

cve-icon Vulnrichment

Updated: 2026-10-28T12:05:10.731Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:09.540

Modified: 2026-10-28T13:17:08.997

Link: CVE-2026-87321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:45:09Z

Weaknesses