---
id: "CVE-2026-87309"
kind: "vulnerability"
aliases: ["CVE-2026-87309"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege HTTP flaw allows data changes and crashes"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterpriseone", "erp", "jd-edwards", "oracle", "self-hosted", "vendor"]
not_affected_if: ["not-jde-enterpriseone", "patched-release"]
published_at: "2026-10-20T22:20:08+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:06:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87309", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege HTTP flaw allows data changes and crashes

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a flaw in the Package Build SEC component reachable over HTTP. An attacker with a low-privilege account can create, modify or delete critical data and cause a repeatable hang or crash of the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 through 9.2.26.5, using the Oracle JD Edwards release level in the environment.
- Check whether the EnterpriseOne web interface is reachable from untrusted networks.

## Fix

- Move EnterpriseOne Tools to a release after 9.2.26.5 using the Oracle Security Alert or Critical Patch Update for this CVE; the exact patched version is unknown from the sources.
- Restrict HTTP access to the EnterpriseOne web tier until patched.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87309

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_