{"id":"CVE-2026-87310","kind":"vulnerability","aliases":["CVE-2026-87310"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker takes over server","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (component Database and Comm SEC): a low-privilege attacker with network access over JDENET can take over EnterpriseOne Tools. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in Oracle's October 2026 CPU. No exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JD Edwards EnterpriseOne Tools","fixed":["9.2.26.6"],"affected":">= 9.2.0.0, <= 9.2.26.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterpriseone","jd-edwards","jdenet","oracle","other","self-hosted","vendor"],"not_affected_if":["managed-hosting","versions-outside-9.2.0.0-9.2.26.5"],"how_to_check":"Check the installed EnterpriseOne Tools release. Exposed if it is 9.2.0.0 to 9.2.26.5 inclusive. Also check whether the JDENET port (default TCP 6017 per Armis) is reachable from untrusted hosts.","fix":"Apply the October 2026 CPU patch for EnterpriseOne Tools from My Oracle Support. Armis gives the fixed release as 9.2.26.6 or later; confirm against Oracle's MOS patch document. Workaround: restrict JDENET (default TCP 6017) to trusted hosts at the firewall. This does not fix the flaw and internal users can still exploit it.","status":"open","published_at":"2026-10-20T22:20:08+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:40+00:00","updated_at":"2026-10-24T00:01:47+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:34:40Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for EnterpriseOne Tools newer than 9.2.26.5; unknown exact patch name from sources.","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker takes over server","impact":"high","summary":"Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 have a flaw in the Database and Comm SEC component. A low-privilege user with network access over JDENET can take over the EnterpriseOne Tools installation.","category":"vendor","who_cares":["jd-edwards","enterpriseone","oracle","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over EnterpriseOne Tools, reading and changing its data and availability.","analyst_note":"Find the Oracle security alert or CPU advisory for CVE-2026-87310 to confirm the patched release and any JDENET mitigation steps.","how_to_check":"Check the installed EnterpriseOne Tools release against 9.2.0.0-9.2.26.5 in the vendor console or release notes; unknown whether sources give a file or command.","needs_analyst":true,"not_affected_if":["versions-outside-9.2.0.0-9.2.26.5"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000564,"input_tokens":3102,"output_tokens":507,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and the patch or version fix for 9.2.26.5 and later, plus the JDENET hardening guidance, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-87310.","search":"'-2026':15A,18A '-87310':16A,19A '/av':151C '2026':75B '3.1':63B,138C,150C '8.8':64B,141C '9.2.0.0':39B,103C '9.2.26.5':41B,104C 'access':54B,114C 'affect':101C 'allow':108C 'attack':10A,51B,111C,124C 'av':65B 'avail':145C 'base':139C 'comm':45B,95C 'compon':42B,92C 'compromis':118C 'confidenti':142C 'cpu':76B 'cve':14A,17A 'cvss':62B,137C,147C,149C 'databas':43B,93C 'easili':105C 'edward':3A,27B,36B,84C,91C,120C,134C 'edwards':21A 'enterpriseon':4A,24B,37B,60B,85C,121C,135C 'enterpriseone':22A 'exploit':78B,106C 'fix':70B 'h':159C 'h/a':158C 'h/i':157C 'host':33B 'impact':146C 'integr':143C 'jd':2A,20A,26B,35B,83C,90C,119C,133C 'jd-edward':25B 'jdenet':28B,56B,116C 'l/pr':67B,153C 'l/ui':68B,154C 'low':7A,49B,109C 'low-privileg':6A,48B 'n':69B 'n/ac':66B,152C 'n/s':155C 'network':9A,53B,113C 'octob':74B 'oracl':1A,29B,72B,89C 'privileg':8A,50B,110C 'product':87C 'report':79B 'result':129C 'score':140C 'sec':46B,96C 'self':32B 'self-host':31B 'server':13A 'success':123C 'support':97C 'take':11A,58B 'takeov':131C 'tool':5A,38B,61B,86C,122C,136C 'tools':23A 'u/c':156C 'vector':148C 'vendor':34B 'version':98C 'via':115C 'vulner':80C,107C,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87310","severity":null,"published_at":"2026-10-20T22:20:08+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87310:571","url":null,"severity":null,"published_at":"2026-10-24T00:01:47+00:00","modified_at":"2026-10-24T00:01:47+00:00","first_seen_at":"2026-10-24T00:01:47+00:00","fetched_at":"2026-10-24T00:01:47+00:00","note":"Oracle CPU Oct 2026 (oracle.com cpuoct2026) lists it; CVE record gives affected 9.2.0.0-9.2.26.5, CVSS 8.8. Fixed 9.2.26.6 and port 6017 mitigation come only from Armis (secondary); Oracle's patch page is behind My Oracle Support and was not read. No exploitation reported; no social posts searched."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2313,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87310","title":"CVE Record: CVE-2026-87310","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2309,"url":"https://cve.armis.com/CVE-2026-87310","title":"CVE-2026-87310 | Armis","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}