CVE-2026-87389
LowCVSS 3.7Summary
Vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management (component: Human Resources) affecting version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 3.7.
Risk Assessment
The risk affects HR data integrity — an attacker could modify some information, potentially impacting HR processes. It requires network access but no authentication.
Recommendation
Apply Oracle updates for JD Edwards EnterpriseOne 9.2 and consider restricting network access to the Human Resources component.
Other vulnerabilities in JD Edwards EnterpriseOne Human Resources Management
See all- CVE-2026-87385Medium
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) affecting version 9.2. An unauthenticated attacker with JDENET network access can, under difficult conditions, gain unauthorized update, insert or delete access to data and read access to a subset of data.
- CVE-2026-87384Medium
Vulnerability in the Human Resources component of Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. A low-privileged attacker with network access via JDENET can perform unauthorized updates, inserts or deletes and cause a partial denial of service.
- CVE-2026-60498High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (version 9.2) in Human Resources component. Difficult to exploit, low-privileged attacker via JDENET can take over the system.
- CVE-2026-60493High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) allows a low-privileged attacker to take over the system over the network via HTTP. Version 9.2 is affected.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS