{"id":"CVE-2026-87307","kind":"vulnerability","aliases":["CVE-2026-87307"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw exposes critical data","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Interoperability SEC component, has a flaw reachable over HTTP. An attacker with a low-privilege account on the network can read critical data and partially disrupt the service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","erp","jd-edwards","on-prem","oracle","vendor"],"not_affected_if":["not-running-enterpriseone","patched-release"],"how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0 through 9.2.26.5 in the Oracle JD Edwards release records\n- Confirm whether the Interoperability SEC component is in use","fix":"- Move EnterpriseOne Tools to a release above `9.2.26.5` as published in Oracle's Critical Patch Update for this CVE\n- unknown: the sources do not name the exact fixed build","status":"open","published_at":"2026-10-20T22:20:07+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:34:19+00:00","updated_at":"2026-10-25T03:34:19+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:34:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move EnterpriseOne Tools to a release above `9.2.26.5` as published in Oracle's Critical Patch Update for this CVE\n- unknown: the sources do not name the exact fixed build","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw exposes critical data","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools, in the Interoperability SEC component, has a flaw reachable over HTTP. An attacker with a low-privilege account on the network can read critical data and partially disrupt the service.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","erp","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads critical data and partially disrupts EnterpriseOne Tools service","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-87307 to get the exact fixed release and any workaround.","how_to_check":"- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0 through 9.2.26.5 in the Oracle JD Edwards release records\n- Confirm whether the Interoperability SEC component is in use","needs_analyst":true,"not_affected_if":["patched-release","not-running-enterpriseone"],"who_is_affected":"Organisations running JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range that expose the HTTP interoperability interface to a network where low-privilege users sit. Sites that have patched to a fixed release or do not run EnterpriseOne Tools can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":3543,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87307':16A,19A '/av':161C '3.1':149C,160C '7.1':152C '9.2.0.0':87C '9.2.26.5':88C 'abil':133C 'access':98C,116C,122C,129C 'account':53B 'affect':85C 'allow':92C 'attack':47B,95C,108C 'avail':155C 'base':150C 'caus':135C 'complet':121C 'compon':39B,78C 'compromis':102C 'confidenti':153C 'critic':12A,59B,118C 'cve':14A,17A 'cvss':148C,157C,159C 'data':13A,60B,119C,130C 'denial':138C 'disrupt':63B 'dos':142C 'easili':89C 'edward':3A,24B,32B,70C,77C,104C,126C,145C 'enterpriseon':4A,20B,33B,71C,105C,127C,146C 'erp':21B 'exploit':90C 'expos':11A 'flaw':10A,42B 'h/i':167C 'http':45B,100C 'impact':156C 'interoper':37B,79C 'jd':2A,23B,31B,69C,76C,103C,125C,144C 'jd-edward':22B 'l':169C 'l/pr':163C 'l/ui':164C 'low':7A,51B,93C 'low-privileg':6A,50B 'n/a':168C 'n/ac':162C 'n/s':165C 'network':9A,56B,97C 'on-prem':25B 'oracl':1A,28B,30B,75C 'partial':62B,137C,141C 'prem':27B 'privileg':8A,52B,94C 'product':73C 'reachabl':43B 'read':58B 'result':113C 'score':151C 'sec':38B,80C 'servic':65B,140C 'success':107C 'support':81C 'tool':5A,34B,72C,106C,128C,147C 'u/c':166C 'unauthor':115C,132C 'vector':158C 'vendor':29B 'version':82C 'via':99C 'vulner':66C,91C,111C","nicknames":[],"mitigations":[],"who_affected":"Organisations running JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range that expose the HTTP interoperability interface to a network where low-privilege users sit. Sites that have patched to a fixed release or do not run EnterpriseOne Tools can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87307","severity":null,"published_at":"2026-10-20T22:20:07+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}