cve-2026-87382

MEDIUM CVSS 6.5 nvd
Description

Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Operational Sourcing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Operational Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Timeline
Published
2026-10-20
Last Modified
2026-10-28
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Affected Products

No product information available.

Weaknesses (CWE)
CWE-200
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 2.8 3.6 secalert_us@oracle.com
NVD metadata
NVD status
Awaiting Analysis
Source identifier
secalert_us@oracle.com
References
Linked Vulnerabilities
cpuoct2026csaf csaf_oracle 

{
  "cvss": 6.5,
  "datePublished": "2026-10-20T22:20:16.360",
  "dateUpdated": "2026-10-28T15:17:08.060",
  "description": "Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Operational Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Operational Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
  "id": "CVE-2026-87382",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "JD Edwards EnterpriseOne Operational Sourcing",
            "vendor": "Oracle Corporation",
            "versions": [
              {
                "status": "affected",
                "version": "9.2",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "secalert_us@oracle.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Operational Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Operational Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)."
      }
    ],
    "id": "CVE-2026-87382",
    "lastModified": "2026-10-28T15:17:08.060",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert_us@oracle.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-87382",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-28T14:31:08.691406Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-20T22:20:16.360",
    "references": [
      {
        "source": "secalert_us@oracle.com",
        "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
      }
    ],
    "sourceIdentifier": "secalert_us@oracle.com",
    "vulnStatus": "Awaiting Analysis",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-200"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operation..."
}
View JSON API Download JSON