CVE-2026-87384

Low-Privilege Network Attack Alters HR Data and Causes Partial Denial of Service in JD Edwards EnterpriseOne Human Resources

View on CVE.org

Published Oct 20, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

Analysis

Technical impact

The vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) permits a low‑privileged attacker who can reach the system through JDENET to update, insert, or delete HR data and to inflict a partial denial of service. It is identified as an integrity and availability issue with a CVSS 3.1 base score of 5.4, indicating a moderate severity. No user interaction is required, and the attack vector is network.

Affected Systems

Products affected are Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. The vulnerability is limited to this release and has no known variants in other versions according to the CNA data.

Risk and Exploitability

The CVSS score of 5.4 reflects a moderate severity. The EPSS score of < 1% indicates a very low probability that this vulnerability will be exploited in the wild, and it is not listed in the CISA KEV catalog. Because only low privileges and network access via JDENET are required, an attacker with internal or nearby network access could reach the target. Such an attacker could alter sensitive HR records or cause a partial denial of service to specific HR modules, potentially disrupting operations and compromising data integrity and compliance reporting.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

JD Edwards EnterpriseOne Human Resources Management

affected

Version	Status	Constraints
`9.2`	affected	—

No data.

Vendor Product Versions

Oracle

Jd Edwards Enterpriseone Human Resources Management

Version	Status	Scheme	Platform
`9.2`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Oracle security patch for JD Edwards EnterpriseOne 9.2 as detailed in the provided security advisory
Restrict JDENET network traffic to trusted hosts by configuring firewall or VLAN rules
Disable or limit JDENET services for users and roles that do not require them

Generated by OpenCVE AI on October 28, 2026 at 19:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.300% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cpuoct2026.html

History

Oct 28, 2026 8:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Low-Privilege Network Attack Alters HR Data and Causes Partial Denial of Service in JD Edwards EnterpriseOne Human Resources

Oct 28, 2026 5:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	JDENET Vulnerability Allows Low‑Privilege HR Data Modification and Partial Denial in Oracle JD Edwards
Weaknesses	CWE-285

Oct 28, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 21, 2026 8:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		JDENET Vulnerability Allows Low‑Privilege HR Data Modification and Partial Denial in Oracle JD Edwards
Weaknesses		CWE-285

Oct 20, 2026 9:30 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
First Time appeared		Oracle Oracle jd Edwards Enterpriseone Human Resources Management
CPEs		cpe:2.3:a:oracle:jd_edwards_enterpriseone_human_resources_management:9.2:::::::*
Vendors & Products		Oracle Oracle jd Edwards Enterpriseone Human Resources Management
References		https://www.oracle.com/security-alerts/cpuoct2026.html
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`