JD Edwards EnterpriseOne Tools CVE-2026-87308

Exploitation requires the attacker to already possess a valid low-privileged logon to the operating-system/host infrastructure where JD Edwards EnterpriseOne Tools executes (CVSS AV:L, PR:L), specifically interacting with the Enterprise Infrastructure SEC component. Affected deployments are JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. Limiting factors: no remote network exploitation is possible (AV:L), the attacker must be authenticated at low privilege rather than anonymous, and there is no availability impact (A:N); however, no special non-default feature or configuration toggle is named in the description, so default installations within the affected version range appear exposed to any local low-privileged account.

This is a moderate-priority vulnerability (Oracle/NVD-aligned CVSS 3.1 base 7.1). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N is internally consistent with the description: exploitation requires a local logon (AV:L) by an already-authenticated low-privileged user (PR:L), is low-complexity (AC:L), needs no user interaction (UI:N), and yields high confidentiality and integrity impact with no availability impact (C:H/I:H/A:N). The AV:L requirement is the single biggest risk-limiting factor - this is not remotely exploitable by an anonymous internet attacker, so it is primarily a privilege-escalation/insider or post-compromise lateral-movement concern rather than a perimeter-breach issue. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this materially lowers near-term real-world risk versus the raw 7.1. One data-quality conflict exists: the input Tags label this 'Authentication Bypass,' yet the description and PR:L both require the attacker to already have a valid low-privileged logon - this is a post-authentication abuse, not an authentication bypass, and the tag appears mislabeled. Net: a legitimate patch-in-normal-cycle item for JD Edwards operators, not an emergency, absent any exploitation signal.

A low-privileged user who already holds a valid logon to the host infrastructure where JD Edwards EnterpriseOne Tools runs leverages a flaw in the Enterprise Infrastructure SEC component to read and modify critical application data beyond their authorization. Because the CVSS vector is AV:L/AC:L/PR:L, the attack is simple to execute but requires existing authenticated local access, making it most realistic as insider abuse or a second stage after an initial foothold. No public exploit code is identified at time of analysis.