---
id: "CVE-2026-87310"
kind: "vulnerability"
aliases: ["CVE-2026-87310"]
title: "Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker takes over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "JD Edwards EnterpriseOne Tools", "fixed": ["9.2.26.6"], "affected": ">= 9.2.0.0, <= 9.2.26.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterpriseone", "jd-edwards", "jdenet", "oracle", "other", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "versions-outside-9.2.0.0-9.2.26.5"]
published_at: "2026-10-20T22:20:08+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:01:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87310", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:01:47+00:00"}]
---

# Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker takes over server

JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (component Database and Comm SEC): a low-privilege attacker with network access over JDENET can take over EnterpriseOne Tools. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Fixed in Oracle's October 2026 CPU. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:JD Edwards EnterpriseOne Tools affected >= 9.2.0.0, <= 9.2.26.5 fixed 9.2.26.6

## How to check

Check the installed EnterpriseOne Tools release. Exposed if it is 9.2.0.0 to 9.2.26.5 inclusive. Also check whether the JDENET port (default TCP 6017 per Armis) is reachable from untrusted hosts.

## Fix

Apply the October 2026 CPU patch for EnterpriseOne Tools from My Oracle Support. Armis gives the fixed release as 9.2.26.6 or later; confirm against Oracle's MOS patch document. Workaround: restrict JDENET (default TCP 6017) to trusted hosts at the firewall. This does not fix the flaw and internal users can still exploit it.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87310
- 2026-10-24T00:01:47+00:00 analyst — Oracle CPU Oct 2026 (oracle.com cpuoct2026) lists it; CVE record gives affected 9.2.0.0-9.2.26.5, CVSS 8.8. Fixed 9.2.26.6 and port 6017 mitigation come only from Armis (secondary); Oracle's patch page is behind My Oracle Support and was not read. No exploitation reported; no social posts searched.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-87310 https://www.cve.org/CVERecord?id=CVE-2026-87310
- [fix] CVE-2026-87310 | Armis https://cve.armis.com/CVE-2026-87310

## From the sources

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_