CVE-2026-87326 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC) versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability is rated with a CVSS 3.1 base score of 5.9, indicating medium severity, primarily impacting confidentiality. Exploitation is considered difficult due to the high attack complexity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains patches for multiple products including JD Edwards EnterpriseOne Tools. Users are strongly advised to apply the relevant patches promptly.
CVE-2026-87325 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to cause denial of service by hanging or crashing the application, as well as unauthorized read and write access to some accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4.
CVE-2026-87324 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) that allows a low privileged attacker with network access via JDENET to cause denial of service and unauthorized data access. The vulnerability can lead to hangs or crashes of the software, unauthorized read access to some data, and unauthorized update, insert, or delete operations on accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4.
CVE-2026-87323 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the software runs to compromise the product, potentially gaining unauthorized access to critical data. The CVSS 3.1 base score is 5.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact.
CVE-2026-87321 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Package Build SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It requires a high privileged attacker with logon access to the infrastructure where the software executes. Successful exploitation can lead to full takeover of the JD Edwards EnterpriseOne Tools, impacting confidentiality, integrity, and availability. The vulnerability is rated with a CVSS 3.1 base score of 6.4, indicating a medium severity level.
CVE-2026-87320 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX) versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure to potentially take over the JD Edwards EnterpriseOne Tools product. Exploitation is difficult and requires user interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 6.7.
CVE-2026-87319 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to potentially compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity with high confidentiality and integrity impact but no availability impact.
A vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) allows a low privileged attacker with logon access to the infrastructure to potentially compromise the application. Exploitation could lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by JD Edwards EnterpriseOne Tools. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.3, impacting confidentiality and integrity but not availability.
CVE-2026-87317 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via SMTP to perform unauthorized update, insert, or delete operations on accessible data and potentially cause a partial denial of service. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.8, reflecting impacts on integrity and availability. Exploitation is considered difficult due to the required conditions. Oracle has included this vulnerability in its October 2026 Critical Patch Update, recommending patch application to mitigate risk.
CVE-2026-87316 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low-privileged attacker with logon access to the infrastructure where the tools execute to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-87315 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating significant integrity impact without affecting confidentiality or availability.
CVE-2026-87314 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via TLS to potentially create, delete, or modify critical data or gain unauthorized access to all accessible data. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with significant confidentiality and integrity impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains patches for multiple products including JD Edwards EnterpriseOne Tools. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk.
CVE-2026-87313 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to fully compromise the product, resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 8.8, impacting confidentiality, integrity, and availability.
CVE-2026-87312 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). It allows a low privileged attacker with network access via JDENET to potentially take over the affected software. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 7.5. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which provides patches for affected versions.
CVE-2026-87311 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to cause a denial of service (DoS) by triggering a hang or repeated crash. The vulnerability is difficult to exploit and impacts availability without compromising confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 5.6 and affects only version 7.2.16 of Oracle VM VirtualBox.
CVE-2026-87310 is a high-severity vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Database and Comm SEC) affecting versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to fully compromise the affected product, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory and provides patches for the affected versions.
CVE-2026-87308 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with logon access to the infrastructure where the tools execute to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by JD Edwards EnterpriseOne Tools. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-87307 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC component) versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or all accessible data within JD Edwards EnterpriseOne Tools. The vulnerability can also enable a partial denial of service. The CVSS 3.1 base score is 7.1, indicating high severity with confidentiality and availability impacts. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
A vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Interoperability SEC) affects versions 9.2.0.0 through 9.2.26.5. It allows a low privileged attacker with network access via JDENET to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-87305 is a vulnerability in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affecting versions 9.2.0.0 through 9.2.26.5. It allows an unauthenticated attacker with network access via SMTP to potentially compromise the product, leading to full takeover. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. Oracle has addressed this vulnerability in their October 2026 Critical Patch Update.