JD Edwards EnterpriseOne CVE-2026-87313

Exploitation requires network reachability to the JDENET communication service (the proprietary EnterpriseOne middleware transport) of the Interoperability SEC component on an affected Tools release (9.2.0.0 through 9.2.26.5). Per CVSS PR:L, the attacker must hold low-level privileges - a valid low-privileged account or existing authenticated foothold in the EnterpriseOne environment - so this is NOT anonymous internet-wide exploitation. Limiting factors: the JDENET service must be network-accessible to the attacker (typically internal or partner-network exposure rather than public internet in well-segmented deployments), and only Tools versions in the 9.2.0.0-9.2.26.5 range are affected; no user interaction is required (UI:N), which removes that barrier.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level authentication and no user interaction, yielding full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) - Oracle's own description characterizes it as 'easily exploitable' resulting in complete takeover of JD Edwards EnterpriseOne Tools. The one meaningful barrier is PR:L: an attacker must already hold some low-privileged foothold or valid low-level credentials on the environment, which constrains purely external anonymous exploitation. No EPSS probability was supplied in the input, so exploitation likelihood cannot be quantified. The CVE is NOT present in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation - treat the 8.8 as representing high intrinsic severity rather than confirmed in-the-wild risk. No SSVC decision data was provided. Signal summary: severity and ease are high and mutually consistent, but the privilege prerequisite and absence of any exploitation/EPSS/POC signal mean this is an urgent-patch item (part of Oracle's October 2026 CPU) rather than a confirmed emergency.

An attacker who already possesses low-privileged access to the environment sends crafted messages to the JDENET network service of an affected JD Edwards EnterpriseOne Tools instance (9.2.0.0-9.2.26.5). Because the flaw is low-complexity and requires no user interaction, the attacker leverages the Interoperability SEC component to escalate to full compromise, gaining control over confidentiality, integrity, and availability of the Tools environment. No public exploit code is referenced at the time of analysis.