CVE-2026-87389 Oracle Corporation CVE debrief

Who should care

Defenders responsible for JD Edwards EnterpriseOne Human Resources Management systems, particularly those with network exposure, should assess their exposure and verify the integrity of their data.

Why it matters

Defenders should care about CVE-2026-87389 because it affects JD Edwards EnterpriseOne Human Resources Management, allowing potential unauthorized data modifications. Those responsible for systems with network exposure should verify exposure and assess data integrity.

• Potential unauthorized modifications to HR data
• Integrity impacts to JD Edwards EnterpriseOne Human Resources Management data
• Verification of system exposure and data integrity is necessary

Technical summary

The vulnerability in JD Edwards EnterpriseOne Human Resources Management (component: Human Resources) affects version 9.2. It is difficult to exploit and allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to unauthorized update, insert, or delete access to some accessible data. The CVSS 3.1 Base Score is 3.7 (Integrity impacts). Defenders should prioritize verifying exposure and assessing the integrity of JD Edwards EnterpriseOne Human Resources Management data. Those responsible for systems with network exposure should verify exposure and assess data integrity.

Defensive priority

Defenders should prioritize verifying exposure and assessing the integrity of JD Edwards EnterpriseOne Human Resources Management data.

Recommended defensive actions

• Verify the integrity of JD Edwards EnterpriseOne Human Resources Management data
• Assess exposure to the vulnerable component
• Review and implement Oracle's recommended security patches or mitigations
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its CVSS score, and potential impacts. Oracle's security alert documentation may offer additional guidance. The vulnerability affects version 9.2 of JD Edwards EnterpriseOne Human Resources Management and allows an unauthenticated attacker with network access via HTTP to compromise the system. The CVSS 3.1 Base Score is 3.7 (Integrity impacts). Defenders should verify the integrity of JD Edwards EnterpriseOne Human Resources Management data and assess exposure to the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.