# CVE-2026-87384: Oracle JD Edwards EnterpriseOne Human Resources data integrity attack via JDENET

Source: https://junglewise.ai/threats/cve-2026-87384-vulnerability-in-the-jd-edwards-enterpriseone-human-resources  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-87384 · Severity: medium · CVSS 5.4 · Published 2026-10-20

Oracle JD Edwards EnterpriseOne Human Resources is a business application that manages employee data and HR operations across enterprises. A vulnerability in version 9.2 allows an attacker with low-level network access to modify, delete, or add employee records and partially disrupt the system's availability, potentially affecting payroll, benefits, and workforce management processes.

Technologies: [Oracle JD Edwards EnterpriseOne Human Resources Management](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-human-resources-management). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-87384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87384 being exploited in the wild.

**How severe is CVE-2026-87384?** Medium severity, with a CVSS score of 5.4, published 20 October 2026.

**Which products and versions are affected?** Oracle JD Edwards EnterpriseOne Human Resources Management 9.2.

**Is there a fix for CVE-2026-87384?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87384 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-87384?** Check whether you run Oracle JD Edwards EnterpriseOne Human Resources Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An easily exploitable vulnerability in the Human Resources component allows low-privileged attackers with network access via the JDENET protocol to compromise the system without user interaction. Successful exploitation grants unauthorized read/write access to HR data and can cause partial denial of service, affecting data integrity and system availability.

## Affected products

- Oracle JD Edwards EnterpriseOne Human Resources Management 9.2

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.oracle.com/security-alerts/cpuoct2026.html](https://www.oracle.com/security-alerts/cpuoct2026.html)

## Related threats

- [Oracle JD Edwards EnterpriseOne Human Resources unauthorized data access](https://junglewise.ai/threats/cve-2026-87385-vulnerability-in-the-jd-edwards-enterpriseone-human-resources)
- [Oracle JD Edwards EnterpriseOne system takeover in Human Resources](https://junglewise.ai/threats/cve-2026-60498-oracle-jd-edwards-enterpriseone-system-takeover-in-human)
- [Oracle JD Edwards EnterpriseOne Human Resources Management takeover vulnerability](https://junglewise.ai/threats/cve-2026-60493-oracle-jd-edwards-enterpriseone-human-resources-management)
- [Oracle JD Edwards EnterpriseOne Human Resources Management auth bypass](https://junglewise.ai/threats/cve-2026-46892-oracle-jd-edwards-enterpriseone-human-resources-management-auth)