JD Edwards EnterpriseOne CVE-2026-87324

Exploitation requires network access to the JD Edwards EnterpriseOne Tools server via the JDENET protocol and an existing low-privilege account/session (PR:L) - it is NOT remote-unauthenticated. The vulnerability is further limited by high attack complexity (AC:H, 'difficult to exploit' per Oracle), implying the attacker must satisfy specific conditions outside their control such as particular server state, timing, or configuration before the hang/crash and limited data access can be triggered. Affected deployments are EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; no user interaction is required (UI:N), but the need for valid low-level privileges plus the difficulty of the trigger substantially constrain realistic exploitation.

This is a moderate-severity (CVSS 6.4) flaw in Oracle JD Edwards EnterpriseOne Tools whose signals point to a bounded, lower-urgency risk rather than a top priority. The CVSS vector (AV:N/AC:H/PR:L/UI:N) shows network reachability via the JDENET protocol but is explicitly tempered by high attack complexity (AC:H, mirrored by Oracle's own 'difficult to exploit' language) and a requirement for existing low-level privileges (PR:L) - so an attacker must already be an authenticated JDENET participant and clear non-trivial conditions. Impact is mixed: availability is high (A:H, complete DOS consistent with the 'Denial Of Service' tag), while confidentiality and integrity are only low (C:L/I:L), yielding the 6.4 rather than a higher score. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the combination of AC:H plus PR:L makes opportunistic mass exploitation unlikely. The chief practical risk is availability disruption of the ERP tier by an attacker who already holds some foothold or valid low-privilege access. Note that no CWE is assigned and no vendor advisory detail beyond the Oracle CPU reference is available, so the precise defect class and exploitation primitive cannot be confirmed from this data.

A low-privileged user who can send messages over the JDENET protocol to an EnterpriseOne Tools server crafts malicious network traffic that, after satisfying difficult timing or state conditions, forces a hang or repeatable crash of the service and achieves limited unauthorized read and write to some accessible data. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation is non-trivial even for an authenticated attacker.