CVE-2026-87308 Oracle Corporation CVE debrief

Who should care

Defenders and administrators of JD Edwards EnterpriseOne Tools systems, especially those with low-privileged user access, should assess exposure and prioritize patching to prevent potential unauthorized data access and modification, and compromise of JD Edwards EnterpriseOne Tools systems. Security teams and vulnerability management teams should also review the vulnerability and implement necessary mitigations.

Why it matters

Defenders should prioritize verifying exposure and applying patches to prevent potential unauthorized data access and modification, and compromise of JD Edwards EnterpriseOne Tools systems.

• Potential unauthorized data access and modification
• Compromise of JD Edwards EnterpriseOne Tools systems
• Elevation of privileges for low-privileged users
• Data integrity and confidentiality impacts

Technical summary

The vulnerability in JD Edwards EnterpriseOne Tools allows low-privileged attackers with logon access to compromise the system, potentially leading to unauthorized data access and modification. The CVSS 3.1 Base Score is 7.1, indicating a high severity. The vulnerability affects versions 9.2.0.0-9.2.26.5 of JD Edwards EnterpriseOne Tools. The vulnerability is easily exploitable and allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on systems with low-privileged user access.

Recommended defensive actions

• Verify system exposure and apply patches
• Restrict logon access for low-privileged users
• Monitor for unauthorized data access and modification
• Implement compensating controls for exposed systems
• Conduct asset inventory to identify affected systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. The vulnerability is in the Enterprise Infrastructure SEC component of JD Edwards EnterpriseOne Tools. The CVSS Vector is (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.