CVE-2026-87384
MediumCVSS 5.4Summary
Vulnerability in the Human Resources component of Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. A low-privileged attacker with network access via JDENET can perform unauthorized updates, inserts or deletes and cause a partial denial of service.
Risk Assessment
An attacker with a basic account can modify HR data and disrupt availability, potentially causing data integrity issues and service interruptions.
Recommendation
Apply Oracle security updates for JD Edwards EnterpriseOne Human Resources Management 9.2 and restrict JDENET access to trusted networks.
Other vulnerabilities in JD Edwards EnterpriseOne Human Resources Management
See all- CVE-2026-87389Low
Vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management (component: Human Resources) affecting version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 3.7.
- CVE-2026-87385Medium
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) affecting version 9.2. An unauthenticated attacker with JDENET network access can, under difficult conditions, gain unauthorized update, insert or delete access to data and read access to a subset of data.
- CVE-2026-60498High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (version 9.2) in Human Resources component. Difficult to exploit, low-privileged attacker via JDENET can take over the system.
- CVE-2026-60493High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) allows a low-privileged attacker to take over the system over the network via HTTP. Version 9.2 is affected.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS