---
id: "CVE-2026-87307"
kind: "vulnerability"
aliases: ["CVE-2026-87307"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw exposes critical data"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "erp", "jd-edwards", "on-prem", "oracle", "vendor"]
not_affected_if: ["not-running-enterpriseone", "patched-release"]
published_at: "2026-10-20T22:20:07+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:34:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87307", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw exposes critical data

Oracle JD Edwards EnterpriseOne Tools, in the Interoperability SEC component, has a flaw reachable over HTTP. An attacker with a low-privilege account on the network can read critical data and partially disrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EnterpriseOne Tools release against the affected range 9.2.0.0 through 9.2.26.5 in the Oracle JD Edwards release records
- Confirm whether the Interoperability SEC component is in use

## Fix

- Move EnterpriseOne Tools to a release above `9.2.26.5` as published in Oracle's Critical Patch Update for this CVE
- unknown: the sources do not name the exact fixed build

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87307

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_