{"id":"CVE-2026-87325","kind":"vulnerability","aliases":["CVE-2026-87325"],"related":[],"title":"Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data access","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Enterprise Infrastructure SEC component reachable over JDENET. A low-privileged attacker on the network can repeatedly crash or hang the service, and read or modify a subset of accessible data.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-erp","enterpriseone","jd-edwards","oracle","vendor"],"not_affected_if":["jdenet-isolated","patched-release"],"how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 to 9.2.26.5 in the Oracle JD Edwards release notes\n- Check whether JDENET ports are reachable from networks outside the trusted application tier","fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that addresses this CVE, per the Oracle advisory\n- Restrict JDENET access to application servers only","status":"open","published_at":"2026-10-20T22:20:09+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:59:27+00:00","updated_at":"2026-10-25T03:59:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:59:27Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne Tools that addresses this CVE, per the Oracle advisory\n- Restrict JDENET access to application servers only","reach":"network","title":"Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data access","impact":"medium","summary":"Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 has a flaw in its Enterprise Infrastructure SEC component reachable over JDENET. A low-privileged attacker on the network can repeatedly crash or hang the service, and read or modify a subset of accessible data.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","enterprise-erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"service crashes repeatedly and some data can be read or changed","analyst_note":"Fetch the Oracle CPU advisory for the fixed patch level and the exact patch name, since the NVD entry alone gives no fix version.","how_to_check":"- Confirm the installed EnterpriseOne Tools release is within 9.2.0.0 to 9.2.26.5 in the Oracle JD Edwards release notes\n- Check whether JDENET ports are reachable from networks outside the trusted application tier","needs_analyst":true,"not_affected_if":["patched-release","jdenet-isolated"],"who_is_affected":"Organisations running JD Edwards EnterpriseOne Tools in the affected 9.2 release range where JDENET traffic can reach the server from a network segment containing low-privileged users. Sites that have already patched or keep JDENET isolated on a private segment are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3596,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87325':15A,18A '/av':186C '3.1':173C,185C '6.4':176C '9.2.0.0':33B,94C '9.2.26.5':35B,95C 'abil':124C 'access':12A,70B,106C,148C,156C,161C,170C 'affect':92C 'allow':8A,100C 'attack':52B,103C,116C 'avail':180C 'base':174C 'caus':126C 'complet':133C 'compon':44B,84C 'compromis':110C 'confidenti':177C 'crash':9A,58B,132C 'cve':13A,16A 'cvss':172C,182C,184C 'data':11A,71B,157C,171C 'delet':147C 'difficult':96C 'dos':134C 'edward':3A,25B,30B,76C,83C,112C,137C,153C,167C 'enterpris':20B,41B,85C 'enterprise-erp':19B 'enterpriseon':4A,22B,31B,77C,113C,138C,154C,168C 'erp':21B 'exploit':98C 'flaw':7A,38B 'frequent':130C 'h':194C 'h/pr':188C 'hang':60B,128C 'impact':181C 'infrastructur':42B,86C 'insert':145C 'integr':178C 'jd':2A,24B,29B,75C,82C,111C,136C,152C,166C 'jd-edward':23B 'jdenet':47B,108C 'l/a':193C 'l/i':192C 'l/ui':189C 'low':50B,101C 'low-privileg':49B 'modifi':66B 'n/ac':187C 'n/s':190C 'network':6A,55B,105C 'oracl':1A,26B,28B,81C 'privileg':51B,102C 'product':79C 'reachabl':45B 'read':64B,160C 'repeat':57B,131C 'result':121C 'score':175C 'sec':43B,87C 'servic':62B 'subset':68B,164C 'success':115C 'support':88C 'tool':5A,32B,78C,114C,139C,155C,169C 'u/c':191C 'unauthor':123C,143C,159C 'updat':144C 'vector':183C 'vendor':27B 'version':89C 'via':107C 'vulner':72C,99C,119C 'well':141C","nicknames":[],"mitigations":[],"who_affected":"Organisations running JD Edwards EnterpriseOne Tools in the affected 9.2 release range where JDENET traffic can reach the server from a network segment containing low-privileged users. Sites that have already patched or keep JDENET isolated on a private segment are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87325","severity":null,"published_at":"2026-10-20T22:20:09+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}