{"id":"CVE-2026-87324","kind":"vulnerability","aliases":["CVE-2026-87324"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data access","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Enterprise Infrastructure SEC component reachable over JDENET. A low-privileged attacker on the network can crash or hang the service and read or modify a subset of the data it can access.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","jd-edwards","jdenet","oracle","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed EnterpriseOne Tools release level against the affected range 9.2.0.0-9.2.26.5 in the Oracle JD Edwards environment\n- unknown for other checks","fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools; the sources do not name the fixed release\n- unknown for other fixes","status":"open","published_at":"2026-10-20T22:20:09+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:59:29+00:00","updated_at":"2026-10-25T03:59:29+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:59:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for JD Edwards EnterpriseOne Tools; the sources do not name the fixed release\n- unknown for other fixes","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data access","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in the Enterprise Infrastructure SEC component reachable over JDENET. A low-privileged attacker on the network can crash or hang the service and read or modify a subset of the data it can access.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","jdenet"],"confidence":0.6,"needs_auth":"yes","worst_case":"Service crashes, and an attacker reads or changes some accessible data","analyst_note":"Find the Oracle Critical Patch Update advisory for JD Edwards EnterpriseOne Tools to confirm the fixed release and the default JDENET exposure.","how_to_check":"- Check the installed EnterpriseOne Tools release level against the affected range 9.2.0.0-9.2.26.5 in the Oracle JD Edwards environment\n- unknown for other checks","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running JD Edwards EnterpriseOne Tools release 9.2.0.0 through 9.2.26.5 with JDENET network access reachable by other users. The sources do not say whether default configurations are exposed, so whether a given deployment is in scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3596,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87324':15A,18A '/av':186C '3.1':173C,185C '6.4':176C '9.2.0.0':31B,94C '9.2.26.5':33B,95C 'abil':124C 'access':12A,71B,106C,148C,156C,161C,170C 'affect':92C 'allow':8A,100C 'attack':50B,103C,116C 'avail':180C 'base':174C 'caus':126C 'complet':133C 'compon':42B,84C 'compromis':110C 'confidenti':177C 'crash':9A,55B,132C 'cve':13A,16A 'cvss':172C,182C,184C 'data':11A,68B,157C,171C 'delet':147C 'difficult':96C 'dos':134C 'edward':3A,22B,28B,76C,83C,112C,137C,153C,167C 'enterpris':39B,85C 'enterpriseon':4A,19B,29B,77C,113C,138C,154C,168C 'exploit':98C 'flaw':7A,36B 'frequent':130C 'h':194C 'h/pr':188C 'hang':57B,128C 'impact':181C 'infrastructur':40B,86C 'insert':145C 'integr':178C 'jd':2A,21B,27B,75C,82C,111C,136C,152C,166C 'jd-edward':20B 'jdenet':23B,45B,108C 'l/a':193C 'l/i':192C 'l/ui':189C 'low':48B,101C 'low-privileg':47B 'modifi':63B 'n/ac':187C 'n/s':190C 'network':6A,53B,105C 'oracl':1A,24B,26B,81C 'privileg':49B,102C 'product':79C 'reachabl':43B 'read':61B,160C 'repeat':131C 'result':121C 'score':175C 'sec':41B,87C 'servic':59B 'subset':65B,164C 'success':115C 'support':88C 'tool':5A,30B,78C,114C,139C,155C,169C 'u/c':191C 'unauthor':123C,143C,159C 'updat':144C 'vector':183C 'vendor':25B 'version':89C 'via':107C 'vulner':72C,99C,119C 'well':141C","nicknames":[],"mitigations":[],"who_affected":"Organizations running JD Edwards EnterpriseOne Tools release 9.2.0.0 through 9.2.26.5 with JDENET network access reachable by other users. The sources do not say whether default configurations are exposed, so whether a given deployment is in scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87324","severity":null,"published_at":"2026-10-20T22:20:09+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}