JD Edwards EnterpriseOne CVE-2026-87323

Exploitation requires the attacker to already have a valid low-privileged logon (PR:L) on the infrastructure/host where JD Edwards EnterpriseOne Tools executes, targeting the Installation Security component; it is a LOCAL vector (AV:L), not remotely reachable over the network. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors that reduce real-world risk: the attacker must first obtain local authenticated access to the EnterpriseOne Tools host, and only installations running affected versions 9.2.0.0 through 9.2.26.5 are exposed; impact is limited to data disclosure with no integrity or availability effect.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score is 5.5 (MEDIUM) and the vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is the dominant signal: exploitation requires LOCAL access (AV:L) and an existing low-privileged, authenticated account (PR:L) on the host where JD Edwards EnterpriseOne Tools runs, which substantially narrows the attacker population versus a network-facing flaw. Impact is confined to confidentiality (C:H, I:N, A:N) - data disclosure only, no integrity or availability loss and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data supplied. The one notable conflict: the input Tags label this 'Authentication Bypass', but the description and CVSS explicitly require a logged-on low-privileged attacker (PR:L), which is the opposite of an unauthenticated bypass - the tag appears mislabeled and should not drive prioritization. Net: a real but bounded local information-disclosure bug typical of an Oracle quarterly CPU entry; patch in normal cycle rather than as an emergency.

An attacker who already holds a low-privileged local account on the server hosting JD Edwards EnteroiseOne Tools leverages a weakness in the Installation Security component to read data they should not be able to access, resulting in disclosure of critical JD Edwards EnterpriseOne data. No public exploit code was identified in the provided data, and the local attack vector with low complexity (AV:L/AC:L) means a motivated insider or an attacker who has already gained a foothold could perform this reliably without user interaction.