Live › vulnerability › CVE-2026-87385
Go to dashboardA flaw in the Human Resources component of Oracle JD Edwards EnterpriseOne 9.2 can be reached over the network through JDENET by an unauthenticated attacker. Successful exploitation allows some HR data to be read and some records to be inserted, updated or deleted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
JD Edwards EnterpriseOne 9.2 installations with the Human Resources Management product where JDENET is reachable from the network. Teams not running EnterpriseOne HR, or with JDENET blocked from untrusted networks, are unlikely to be exposed. Sources do not say which patch level resolves it.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87385")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.