JD Edwards EnterpriseOne CVE-2026-87320

Exploitation requires ALL of the following to hold simultaneously: (1) the attacker must already possess a low-privileged account with logon access to the UNIX infrastructure where JD Edwards EnterpriseOne Tools executes (AV:L, PR:L) - there is no remote/network-facing attack path; (2) a separate human (not the attacker) must perform a triggering interaction (UI:R); and (3) difficult-to-satisfy conditions must be met (AC:H), implying timing, specific state, or non-trivial setup. The affected component is specifically 'E1 Dev Platform Tech - UNIX' in Tools versions 9.2.0.0 through 9.2.26.5, so Windows or non-Dev-Platform deployments and versions outside this range are not in scope. These combined local-foothold, authentication, and victim-interaction requirements are the primary factors limiting real-world exploitation.

This is a moderate-severity issue (CVSS 3.1 base 6.7) that does not warrant top-tier emergency prioritization. The CVSS vector itself tempers the high impact: AV:L means the attacker must already have logon access to the infrastructure where JD Edwards EnterpriseOne Tools runs (not remotely reachable over a network), AC:H indicates the attack is difficult to exploit and may require specific conditions or a race, PR:L requires an existing low-privileged account, and UI:R requires a separate human victim to take an action. Four independent mitigating preconditions must align simultaneously, which substantially lowers real-world exploitability despite the full C:H/I:H/A:H 'takeover' impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified; it is NOT listed in CISA KEV and no public exploit code is referenced - therefore exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Signals are internally consistent (local, high-complexity, authenticated, interaction-dependent all point to a hard-to-exploit insider/foothold scenario rather than mass exploitation). One metadata caveat: the input Tags label this 'Information Disclosure,' but the description and the C:H/I:H/A:H vector describe full product takeover affecting all three security properties - the tag understates the impact and should not be relied on for triage.

An attacker who already holds a low-privileged account on the UNIX host running JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.5) stages a malicious artifact or action and then waits for or socially engineers a separate, higher-context user to perform an interaction that triggers the flaw. The difficult-to-exploit conditions (AC:H) succeed, resulting in compromise and takeover of the EnterpriseOne Tools environment. No public proof-of-concept or exploit code is referenced in the available data.