CVE-2026-87324 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Tools deployments, particularly those with network access via JDENET, should assess exposure and apply patches to prevent potential denial of service and data access impacts.

Why it matters

Defenders should care about CVE-2026-87324 as it can lead to potential denial of service and unauthorized data access in JD Edwards EnterpriseOne Tools deployments, particularly those with network access via JDENET. The vulnerability requires low privileged access and has a medium CVSS score of 6.4. Defenders responsible for JD Edwards EnterpriseOne Tools should assess exposure and apply patches.

• Potential denial of service (complete DOS) of JD Edwards EnterpriseOne Tools
• Unauthorized update, insert or delete access to some JD Edwards EnterpriseOne Tools accessible data
• Unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data

Technical summary

The vulnerability in JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) allows low privileged attackers with network access via JDENET to potentially cause a hang or crash of JD Edwards EnterpriseOne Tools and gain unauthorized access to some data. The CVSS 3.1 Base Score is 6.4 (Confidentiality, Integrity and Availability impacts). The vector is (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H). The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5. Defenders should assess exposure and apply patches to prevent potential denial of service and data access impacts.

Defensive priority

Medium priority for defenders to assess exposure and apply patches, given the potential for denial of service and data access impacts.

Recommended defensive actions

• Assess exposure of JD Edwards EnterpriseOne Tools in your environment
• Apply patches or updates provided by Oracle
• Monitor JDENET network access for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE and NVD records provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert also provides relevant information. The vulnerability affects JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.5. The CVSS 3.1 Base Score is 6.4 (Confidentiality, Integrity and Availability impacts). The vector is (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H). Defenders should verify the affected versions in their environment and review the official advisory for specific patch guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.