Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-10-20
Score: 3.6 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data update, insert, delete, and read
Action: Patch
AI Analysis

Impact

The vulnerability in JD Edwards EnterpriseOne Tools allows an attacker who has already logged onto the underlying infrastructure with low privileges to read a subset of data or to perform unauthorized updates, inserts, or deletes. The flaw stems from insufficient authorization checks in the Enterprise Infrastructure SEC component, resulting in both confidentiality (information exposure) and integrity (data modification) impacts as identified by CWE‑200.

Affected Systems

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. No other vendor or product is listed as impacted.

Risk and Exploitability

Exploitation requires local access and a low privilege account, making the attack vector local and the overall exploit difficulty high. The CVSS v3.1 base score of 3.6 reflects modest confidentiality and integrity effects. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low overall likelihood of widespread exploitation but a tangible risk if local privileges are present.

Generated by OpenCVE AI on October 28, 2026 at 17:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for JD Edwards EnterpriseOne Tools covering versions 9.2.0.0 through 9.2.26.5
  • Restrict local logon rights on the JD Edwards infrastructure to users who absolutely need them, enforcing strict least‑privilege access control
  • Monitor database activity for unexpected insert, update, or delete operations and review logs for signs of unauthorized access

Generated by OpenCVE AI on October 28, 2026 at 17:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Local Privileged Client Data Exposure and Modification Vulnerability

Wed, 28 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Local Privilege Data Modification Vulnerability
Weaknesses CWE-284

Wed, 28 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title JD Edwards EnterpriseOne Tools Local Privilege Data Modification Vulnerability
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T12:38:50.791Z

Reserved: 2026-09-08T21:49:12.412Z

Link: CVE-2026-87333

cve-icon Vulnrichment

Updated: 2026-10-28T12:38:27.303Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:10.907

Modified: 2026-10-28T13:17:20.050

Link: CVE-2026-87333

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T17:45:02Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor