EnterpriseOne Tools CVE-2026-87309

Exploitation requires the attacker to hold a valid low-privileged account on the target (CVSS PR:L), reachable over the network via HTTP against the Package Build SEC component of JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. No user interaction and no elevated privileges are needed, and attack complexity is low, so any authenticated low-tier user with HTTP access to the application can attempt it. The primary limiting factor is the authentication requirement (not remote-unauthenticated) and network exposure of the EnterpriseOne Tools HTTP interface; environments that restrict the Tools web layer to trusted internal networks and tightly control low-privilege account provisioning materially reduce exposure. No special non-default product feature or configuration is named in the description as a precondition.

This is a genuinely high-priority vulnerability by its technical characteristics but the exploitation-signal picture is incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding HIGH integrity and HIGH availability impact (no confidentiality impact). Oracle's own description reinforces this, calling it 'easily exploitable' by a 'low privileged attacker with network access via HTTP.' However, no EPSS probability, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these signals is typical for a freshly disclosed Oracle Critical Patch Update item and should NOT be read as low risk - Oracle CPU vulnerabilities routinely lack EPSS/KEV data at disclosure yet remain attractive targets. Net: treat as a real patch priority driven by the strong CVSS profile and low privilege barrier, while recognizing that current real-world exploitation data is simply missing rather than confirmed-low. One minor consistency note: CVSS marks C:N (no confidentiality impact) yet the description mentions 'unauthorized creation, deletion or modification access to critical data... and all JD Edwards EnterpriseOne Tools accessible data' plus complete DOS - this aligns with I:H/A:H and C:N, so the vector and description are consistent.

An attacker who already holds a low-privileged JD Edwards EnterpriseOne Tools account (e.g., a standard application user) sends crafted HTTP requests to the Package Build SEC component over the network. Because attack complexity is low and no user interaction is needed, the attacker tampers with or destroys critical business data and/or forces a complete, repeatable denial of service of the application. No public exploit code was identified at time of analysis.