---
id: "CVE-2026-87386"
kind: "vulnerability"
aliases: ["CVE-2026-87386"]
title: "Oracle JD Edwards EnterpriseOne General Ledger: low-privilege user can crash service"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["enterpriseone", "erp", "jd-edwards", "oracle", "package"]
not_affected_if: ["no-jdenet-exposure", "not-on-version-9.2"]
published_at: "2026-10-20T22:20:16+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:22:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87386", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle JD Edwards EnterpriseOne General Ledger: low-privilege user can crash service

Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) can be made to hang or repeatedly crash by an authenticated low-privilege user over JDENET. The result is a denial of service; the sources report no confidentiality or integrity impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87386

## From the sources

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne General Ledger.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_