CVE-2026-87385
MediumCVSS 4.8Summary
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) affecting version 9.2. An unauthenticated attacker with JDENET network access can, under difficult conditions, gain unauthorized update, insert or delete access to data and read access to a subset of data.
Risk Assessment
An unauthenticated attacker can modify HR data and read a subset of data, compromising the confidentiality and integrity of employee information.
Recommendation
Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne 9.2 and restrict access to the JDENET protocol.
Other vulnerabilities in JD Edwards EnterpriseOne Human Resources Management
See all- CVE-2026-87389Low
Vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management (component: Human Resources) affecting version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 3.7.
- CVE-2026-87384Medium
Vulnerability in the Human Resources component of Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. A low-privileged attacker with network access via JDENET can perform unauthorized updates, inserts or deletes and cause a partial denial of service.
- CVE-2026-60498High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (version 9.2) in Human Resources component. Difficult to exploit, low-privileged attacker via JDENET can take over the system.
- CVE-2026-60493High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) allows a low-privileged attacker to take over the system over the network via HTTP. Version 9.2 is affected.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS