Oracle JD Edwards EnterpriseOne Tools: Data integrity and availability impact via HTTP
Summary
A flaw in the Package Build SEC component of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be exploited over the network via HTTP. An attacker with a low-privileged account can create, delete or modify critical data and cause a hang or repeatable crash of the application. No user interaction is required. Exposure of the EnterpriseOne web interface determines the practical risk.
Affected
- Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5
- Component: Package Build SEC
- CVSS 3.1: 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Fixed in
Unknown. The fixed release or patch ID is not confirmed in the sources reviewed. Check Oracle's October 2026 Critical Patch Update advisory or My Oracle Support.
Workaround
Unknown. No official mitigation is documented.
Exploitation
- Exploitation in the wild: Unknown. No evidence found, no CISA KEV listing and no public proof of concept at the time of research.
- CISA SSVC: Automatable yes, technical impact total.
Our recommendation
- Confirm whether the customer runs JD Edwards EnterpriseOne Tools 9.2.0.0 to 9.2.26.5.
- Check whether the EnterpriseOne HTTP interface is reachable from the internet; if so, treat as high priority.
- Restrict HTTP access to the EnterpriseOne web tier to internal networks or VPN.
- Review and reduce low-privileged accounts and monitor for unusual application activity.
- Apply the complete October 2026 Oracle Critical Patch Update once the fixed patch level is confirmed.
- Re-check CISA KEV and vendor channels for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- NVD/Vulners record CVE-2026-87309 vulners.com
- Strix CVE-2026-87309 www.strix.ai
- eSecurityPlanet: Oracle October 2026 Critical Patch Update www.esecurityplanet.com
- HivePro: Oracle October 2026 Critical Patch Update www.hivepro.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:17.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.