Live › vulnerability › CVE-2026-87315
Go to dashboardOracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Enterprise Infrastructure SEC component that can be reached over HTTP without logging in. An attacker can create, delete or modify data the application can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organisations running Oracle JD Edwards EnterpriseOne Tools in the 9.2.0.0 to 9.2.26.5 range with the web interface reachable over HTTP. Exposure depends on whether the HTTP endpoint is accessible to the network the attacker can reach; deployments only reachable from a locked-down internal network carry less risk. Teams on other releases or without EnterpriseOne can skip it.
No product ranges from the sources yet.
9.2.0.0 and 9.2.26.5 in the Oracle JD Edwards release recordEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87315")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.