CVE-2026-87380

JD Edwards Sales Order Entry - Low-privileged Data Exposure via JDENET

Published Oct 20, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwards (component: Sales Order Entry). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Sales Order Entry. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Sales Order Entry accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Analysis

Technical impact

This vulnerability is an access-control flaw in the Sales Order Entry component of Oracle JD Edwards EnterpriseOne 9.2. A low-privileged attacker who can reach the system over the JDENET network can exploit the flaw to read sensitive data, effectively bypassing normal authorization controls. The CVSS 3.1 score of 6.5 reflects that the flaw has a high impact on confidentiality while not affecting integrity or availability.

Affected Systems

Oracle JD Edwards EnterpriseOne Sales Order Entry 9.2 is the only version affected. The product is part of Oracle’s JD Edwards suite.

Risk and Exploitability

Because the attack requires only network access to JDENET and a low-privileged user account, the attack vector is relatively straightforward. The EPSS score of <1% (approximately 0.00355) indicates a very low but non-zero likelihood of exploitation, while the CVSS score of 6.5 highlights significant confidentiality impact. The vulnerability is not listed in CISA’s KEV catalog, implying that no confirmed exploitation has been documented. Nonetheless, the combination of easy exploitation prerequisites and high potential impact warrants prompt attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

JD Edwards EnterpriseOne Sales Order Entry

affected

Version	Status	Constraints
`9.2`	affected	—

No data.

Vendor Product Versions

Oracle

Jd Edwards Enterpriseone Sales Order Entry

Version	Status	Scheme	Platform
`9.2`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Oracle CPU Oct 2026 patch that addresses the JD Edwards EnterpriseOne Sales Order Entry vulnerability.
Restrict JDENET access to users with the appropriate privilege levels and block external network connections where possible.
Enable or enforce strict role‑based access control for the Sales Order Entry component, ensuring that low-privileged accounts cannot read sensitive data.

Generated by OpenCVE AI on October 28, 2026 at 19:07 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.355% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cpuoct2026.html

History

Oct 28, 2026 7:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		JD Edwards Sales Order Entry - Low-privileged Data Exposure via JDENET

Oct 28, 2026 5:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthorized Data Access via JDENET in JD Edwards EnterpriseOne Sales Order Entry
Weaknesses	CWE-284

Oct 28, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 21, 2026 5:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Unauthorized Data Access via JDENET in JD Edwards EnterpriseOne Sales Order Entry
Weaknesses		CWE-284

Oct 20, 2026 9:30 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwards (component: Sales Order Entry). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Sales Order Entry. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Sales Order Entry accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared		Oracle Oracle jd Edwards Enterpriseone Sales Order Entry
CPEs		cpe:2.3:a:oracle:jd_edwards_enterpriseone_sales_order_entry:9.2:::::::*
Vendors & Products		Oracle Oracle jd Edwards Enterpriseone Sales Order Entry
References		https://www.oracle.com/security-alerts/cpuoct2026.html
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`