CVE-2026-87388

MediumCVSS 5.3

Published: 20/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Vulnerability in JD Edwards EnterpriseOne Configurator (Configuration Management component) affecting version 9.2. A low-privileged attacker with HTTP network access can, under difficult conditions, gain unauthorized creation, deletion or modification of critical data.

Risk Assessment

A low-privileged attacker can modify or delete critical configuration data, compromising the integrity of the ERP system.

Recommendation

Apply the Oracle Critical Patch Update for JD Edwards EnterpriseOne 9.2 and restrict network access to HTTP interfaces.

Other vulnerabilities in JD Edwards EnterpriseOne Configurator

CVE-2026-60620Medium
Vulnerability in the Configuration Management component of JD Edwards EnterpriseOne Configurator (Oracle JD Edwards). A low-privileged attacker via HTTP can cause a complete DoS (hang or frequent crashes) and gain unauthorized data access.

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Configurator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Configurator accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS