{"id":"CVE-2026-87309","kind":"vulnerability","aliases":["CVE-2026-87309"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege HTTP flaw allows data changes and crashes","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Package Build SEC component reachable over HTTP. An attacker with a low-privilege account can create, modify or delete critical data and cause a repeatable hang or crash of the service.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","erp","jd-edwards","oracle","self-hosted","vendor"],"not_affected_if":["not-jde-enterpriseone","patched-release"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, using the Oracle JD Edwards release level in the environment.\n- Check whether the EnterpriseOne web interface is reachable from untrusted networks.","fix":"- Move EnterpriseOne Tools to a release after 9.2.26.5 using the Oracle Security Alert or Critical Patch Update for this CVE; the exact patched version is unknown from the sources.\n- Restrict HTTP access to the EnterpriseOne web tier until patched.","status":"open","published_at":"2026-10-20T22:20:08+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:06:10+00:00","updated_at":"2026-10-25T03:06:10+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T03:06:10Z","model":"claude-haiku-5-5","output":{"fix":"- Move EnterpriseOne Tools to a release after 9.2.26.5 using the Oracle Security Alert or Critical Patch Update for this CVE; the exact patched version is unknown from the sources.\n- Restrict HTTP access to the EnterpriseOne web tier until patched.","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege HTTP flaw allows data changes and crashes","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Package Build SEC component reachable over HTTP. An attacker with a low-privilege account can create, modify or delete critical data and cause a repeatable hang or crash of the service.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","erp","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker alters or deletes critical ERP data and crashes the service.","analyst_note":"Find the Oracle security alert or CPU entry for CVE-2026-87309 to confirm the patched release and any workaround; the NVD entry gives only the affected range.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, using the Oracle JD Edwards release level in the environment.\n- Check whether the EnterpriseOne web interface is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["not-jde-enterpriseone","patched-release"],"who_is_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the affected 9.2 release range that expose the HTTP interface to users or networks. Attack requires only a low-privilege account and network access over HTTP, so internal networks with many user accounts are exposed too. Teams not running JD Edwards EnterpriseOne can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":3550,"output_tokens":734,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-87309':18A,21A '/av':176C '3.1':164C,175C '8.1':167C '9.2.0.0':38B,100C '9.2.26.5':40B,101C 'abil':147C 'access':111C,133C,143C 'account':60B 'affect':98C 'allow':11A,105C 'attack':54B,108C,121C 'avail':170C 'base':165C 'build':47B,92C 'caus':69B,149C 'chang':13A 'complet':156C 'compon':49B,90C 'compromis':115C 'contain':41B 'crash':15A,74B,155C 'creat':62B 'creation':129C 'critic':66B,135C 'cve':16A,19A 'cvss':163C,172C,174C 'data':12A,67B,136C,144C 'delet':65B,130C 'dos':157C 'easili':102C 'edward':3A,26B,34B,82C,89C,117C,140C,160C 'enterpriseon':4A,22B,35B,83C,118C,141C,161C 'erp':23B 'exploit':103C 'flaw':10A,43B 'frequent':153C 'h':184C 'h/a':183C 'hang':72B,151C 'host':30B 'http':9A,52B,113C 'impact':171C 'integr':168C 'jd':2A,25B,33B,81C,88C,116C,139C,159C 'jd-edward':24B 'l/pr':178C 'l/ui':179C 'low':7A,58B,106C 'low-privileg':6A,57B 'modif':132C 'modifi':63B 'n/ac':177C 'n/i':182C 'n/s':180C 'network':110C 'oracl':1A,27B,32B,87C 'packag':46B,91C 'privileg':8A,59B,107C 'product':85C 'reachabl':50B 'repeat':71B,154C 'result':126C 'score':166C 'sec':48B,93C 'self':29B 'self-host':28B 'servic':77B 'success':120C 'support':94C 'tool':5A,36B,84C,119C,142C,162C 'u/c':181C 'unauthor':128C,146C 'vector':173C 'vendor':31B 'version':37B,95C 'via':112C 'vulner':78C,104C,124C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle JD Edwards EnterpriseOne Tools in the affected 9.2 release range that expose the HTTP interface to users or networks. Attack requires only a low-privilege account and network access over HTTP, so internal networks with many user accounts are exposed too. Teams not running JD Edwards EnterpriseOne can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87309","severity":null,"published_at":"2026-10-20T22:20:08+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}