{"id":"CVE-2026-87385","kind":"vulnerability","aliases":["CVE-2026-87385"],"related":[],"title":"Oracle JD Edwards EnterpriseOne HR: unauthenticated network flaw allows data read and change","description":"Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","summary":"A flaw in the Human Resources component of Oracle JD Edwards EnterpriseOne 9.2 can be reached over the network through JDENET by an unauthenticated attacker. Successful exploitation allows some HR data to be read and some records to be inserted, updated or deleted.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterpriseone","hr-systems","jd-edwards","oracle","vendor"],"not_affected_if":["jdenet-not-reachable","no-hr-module"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:20:16+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:33:13+00:00","updated_at":"2026-10-25T04:33:13+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:33:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle JD Edwards EnterpriseOne HR: unauthenticated network flaw allows data read and change","impact":"medium","summary":"A flaw in the Human Resources component of Oracle JD Edwards EnterpriseOne 9.2 can be reached over the network through JDENET by an unauthenticated attacker. Successful exploitation allows some HR data to be read and some records to be inserted, updated or deleted.","category":"vendor","nicknames":[],"who_cares":["jd-edwards","enterpriseone","oracle","hr-systems"],"confidence":0.6,"needs_auth":"no","worst_case":"Some HR records readable, insertable, updatable or deletable over JDENET","analyst_note":"Check Oracle's Critical Patch Update advisory for CVE-2026-87385 for the fixed patch level and any mitigation for JDENET exposure; the NVD entry gives neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["jdenet-not-reachable","no-hr-module"],"who_is_affected":"JD Edwards EnterpriseOne 9.2 installations with the Human Resources Management product where JDENET is reachable from the network. Teams not running EnterpriseOne HR, or with JDENET blocked from untrusted networks, are unlikely to be exposed. Sources do not say which patch level resolves it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3538,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87385':16A,19A '/av':173C '3.1':161C,172C '4.8':164C '9.2':41B,96C 'access':106C,130C,140C,147C,158C 'affect':94C 'allow':9A,56B,101C 'attack':53B,103C,118C 'base':162C 'chang':13A 'compon':35B,86C 'compromis':110C 'confidenti':165C 'cve':14A,17A 'cvss':160C,169C,171C 'data':10A,59B,141C,159C 'delet':71B,129C 'difficult':97C 'edward':3A,26B,39B,76C,85C,112C,135C,153C 'enterpriseon':4A,20B,40B,77C,113C,136C,154C 'exploit':55B,99C 'flaw':8A,30B 'h/pr':175C 'hr':5A,22B,58B 'hr-system':21B 'human':33B,78C,87C,114C,137C,155C 'impact':168C 'insert':68B,127C 'integr':167C 'jd':2A,25B,38B,75C,84C,111C,134C,152C 'jd-edward':24B 'jdenet':49B,108C 'l/a':180C 'l/i':179C 'manag':80C,116C,139C,157C 'n':181C 'n/ac':174C 'n/s':177C 'n/ui':176C 'network':7A,47B,105C 'oracl':1A,27B,37B,83C 'product':81C 'reach':44B 'read':11A,62B,146C 'record':65B 'resourc':34B,79C,88C,115C,138C,156C 'result':123C 'score':163C 'subset':150C 'success':54B,117C 'support':90C 'system':23B 'u/c':178C 'unauthent':6A,52B,102C 'unauthor':125C,145C 'updat':69B,126C 'vector':170C 'vendor':28B 'version':91C 'via':107C 'vulner':72C,100C,121C 'well':143C","nicknames":[],"mitigations":[],"who_affected":"JD Edwards EnterpriseOne 9.2 installations with the Human Resources Management product where JDENET is reachable from the network. Teams not running EnterpriseOne HR, or with JDENET blocked from untrusted networks, are unlikely to be exposed. Sources do not say which patch level resolves it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87385","severity":null,"published_at":"2026-10-20T22:20:16+00:00","modified_at":"2026-10-21T18:44:40+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}