CVE-2026-87386 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne General Ledger deployments, particularly those using version 9.2, should assess exposure and implement mitigations to prevent potential DOS attacks.

Why it matters

CVE-2026-87386 is a medium-severity vulnerability in JD Edwards EnterpriseOne General Ledger that allows low-privileged attackers to cause DOS. Defenders should verify exposure, assess network access controls, and implement mitigations to prevent potential DOS attacks.

• Potential DOS attacks could impact business operations relying on JD Edwards EnterpriseOne General Ledger.
• Verify JD Edwards EnterpriseOne General Ledger version 9.2 exposure and assess network access controls.
• Implement mitigations to prevent potential DOS attacks.

Technical summary

The vulnerability in JD Edwards EnterpriseOne General Ledger (component: E1 Foundation) allows a low-privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne General Ledger, potentially causing a hang or frequently repeatable crash (complete DOS). The CVSS 3.1 Base Score is 5.3 (Availability impacts). Defenders should prioritize verifying exposure of JD Edwards EnterpriseOne General Ledger version 9.2 and assessing network access controls to mitigate potential DOS attacks. The supported version affected is 9.2.

Defensive priority

Defenders should prioritize verifying exposure of JD Edwards EnterpriseOne General Ledger version 9.2 and assessing network access controls to mitigate potential DOS attacks.

Recommended defensive actions

• Verify JD Edwards EnterpriseOne General Ledger version 9.2 exposure in your environment.
• Assess and restrict network access via JDENET to JD Edwards EnterpriseOne General Ledger.
• Review and apply Oracle's security updates for JD Edwards EnterpriseOne General Ledger.
• Monitor for potential DOS attacks and review relevant logs.
• Perform asset inventory of JD Edwards EnterpriseOne General Ledger deployments.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its CVSS score, and potential impacts. Oracle's security alert page may contain additional details. Defenders should verify the exposure of JD Edwards EnterpriseOne General Ledger version 9.2 and assess network access controls to mitigate potential DOS attacks. The vulnerability allows a low-privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne General Ledger, potentially causing a hang or frequently repeatable crash (DOS).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.