CVE-2026-87383

Privilege Escalation in JD Edwards EnterpriseOne Tools Package Build SEC Component

Published Oct 20, 2026 CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

The vulnerability exists in the Package Build SEC component of the JD Edwards EnterpriseOne Tools product and permits a high privileged attacker who has logged on to the infrastructure where the tools run to fully compromise JD Edwards EnterpriseOne Tools. Successful exploitation can result in the attacker taking full control of the tools, leading to confidentiality, integrity and availability impacts on the entire JD Edwards environment.

Affected Systems

Oracle Corporation JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5.

Risk and Exploitability

The CVSS 3.1 score of 6.7 indicates a medium severity with local attack access but high privileges required. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalogue, indicating a low likelihood of exploitation for the general public. Nevertheless, the attacker needs privileged local access to gain control of JD Edwards EnterpriseOne Tools, making the risk significant for systems where such privileges exist.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

JD Edwards EnterpriseOne Tools

affected

Version	Status	Constraints
`9.2.0.0`	affected	≤ 9.2.26.5

Configuration 1 [-]

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Jd Edwards Enterpriseone Tools

Version	Status	Scheme	Platform
`[9.2.0.0,9.2.26.5]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update JD Edwards EnterpriseOne Tools to the latest patched version that addresses the Package Build SEC flaw
If a patch is unavailable, disable or remove the Package Build SEC component from the environment
Implement strict privileged access controls, ensuring only trusted administrators can log on to the JD Edwards infrastructure
Apply network segmentation so that the JD Edwards infrastructure is isolated from other parts of the enterprise network

Generated by OpenCVE AI on October 28, 2026 at 19:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.178% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cpuoct2026.html

History

Oct 28, 2026 7:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Privilege Escalation in JD Edwards EnterpriseOne Tools Package Build SEC Component

Oct 28, 2026 5:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Privilege Escalation in JD Edwards EnterpriseOne Tools
Weaknesses	CWE-269 CWE-284

Oct 28, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 21, 2026 8:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Privilege Escalation in JD Edwards EnterpriseOne Tools
Weaknesses		CWE-269 CWE-284

Oct 20, 2026 9:30 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle jd Edwards Enterpriseone Tools
CPEs		cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools::::::::
Vendors & Products		Oracle Oracle jd Edwards Enterpriseone Tools
References		https://www.oracle.com/security-alerts/cpuoct2026.html
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`