Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
Published: 2026-10-20
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Integrity & Availability: Unauthorized data manipulation and partial denial of service by an authenticated high‑privileged user
Action: Patch Soon
AI Analysis

Impact

The vulnerability in JD Edwards EnterpriseOne Tools enables an attacker with high privileges on the same infrastructure to perform unauthorized updates, inserts, or deletions of data, read restricted data, and trigger a partial denial of service. This results in compromise of data confidentiality, integrity, and availability as described by the CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The weaknesses involved are typical of improper access controls where privileged users can override authorization checks.

Affected Systems

The affected editions are Oracle JD Edwards EnterpriseOne Tools, specifically the E1 Dev Platform Tech – UNIX component, with supported versions ranging from 9.2.0.0 through 9.2.26.5. Only installations of these versions are impacted; newer releases are not affected.

Risk and Exploitability

The CVSS base score of 4.2 indicates low severity, and the EPSS score of 0.00143 indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker already have high‑privilege access to the host where JD Edwards EnterpriseOne Tools runs; no remote access or user interaction is needed.

Generated by OpenCVE AI on October 28, 2026 at 18:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch or upgrade JD Edwards EnterpriseOne Tools to a non‑affected version as soon as available
  • Restrict high‑privilege accounts to the minimum necessary permissions and enforce the principle of least privilege
  • Audit and monitor database operations for abnormal modification and deletion actions, and review logs for potential partial denial‑of‑service events

Generated by OpenCVE AI on October 28, 2026 at 18:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Title Local High-Privilege Access Enables Unauthorized Data Manipulation and Partial Denial of Service in JD Edwards EnterpriseOne Tools

Wed, 28 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Allow Privileged Users to Modify Data and Cause Partial Denial of Service
Weaknesses CWE-284
CWE-285

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Allow Privileged Users to Modify Data and Cause Partial Denial of Service
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T13:22:28.133Z

Reserved: 2026-09-08T21:49:12.411Z

Link: CVE-2026-87330

cve-icon Vulnrichment

Updated: 2026-10-28T13:22:15.503Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:10.560

Modified: 2026-10-28T14:17:05.680

Link: CVE-2026-87330

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T18:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor