CVE-2026-87384 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Human Resources Management systems, particularly those with network access exposed, should assess exposure and prioritize patching and monitoring.

Why it matters

CVE-2026-87384 is a medium-severity vulnerability in JD Edwards EnterpriseOne Human Resources Management that allows low-privileged attackers with network access to potentially modify data and cause partial denial of service conditions. Defenders should prioritize verifying exposure, applying patches, and monitoring for unauthorized access and data changes.

• Potential unauthorized data modifications by low-privileged attackers.
• Risk of partial denial of service conditions.
• Need for verification of exposure and application of patches.
• Importance of monitoring for unauthorized access and data changes.

Technical summary

The vulnerability in JD Edwards EnterpriseOne Human Resources Management allows a low-privileged attacker with network access via JDENET to compromise the system, potentially resulting in unauthorized update, insert, or delete access to some accessible data and a partial denial of service. This medium-severity vulnerability has a CVSS score of 5.4 and impacts data integrity and availability. The affected version is 9.2, and defenders should prioritize verifying exposure, applying patches, and monitoring for unauthorized data modifications.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on network access controls and monitoring for unauthorized data modifications.

Recommended defensive actions

• Verify and apply patches from Oracle for JD Edwards EnterpriseOne Human Resources Management version 9.2.
• Implement network access controls to restrict access to JD Edwards EnterpriseOne Human Resources Management.
• Monitor for unauthorized data modifications and partial denial of service conditions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions. Oracle's security alert documentation is also available for reference. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. It allows low-privileged attackers with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management, potentially resulting in unauthorized update, insert, or delete access to some accessible data and a partial denial of service. The CVE record was last on

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.