EnterpriseOne Tools CVE-2026-87325

Exploitation requires network reachability to the JD Edwards EnterpriseOne Tools server over the proprietary JDENET protocol AND a valid low-privileged authenticated account (CVSS PR:L) - it is not anonymous. Oracle explicitly rates the vulnerability as 'difficult to exploit' (AC:H), meaning success depends on specific conditions such as race/timing or particular server state rather than a simple single request. Affected deployments are EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; the Enterprise Infrastructure SEC component must be in use. The primary limiting factors for defenders are the required authentication, the high attack complexity, and the fact that JDENET is typically exposed only on internal enterprise networks rather than the public internet.

This is a moderate-priority vulnerability that should be patched in the normal Oracle Critical Patch Update cycle rather than treated as an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4) shows a network-reachable flaw via the JDENET protocol, but exploitation is explicitly rated high-complexity (AC:H) and requires an already-authenticated low-privileged account (PR:L), which materially constrains opportunistic attacks. The dominant impact is availability (A:H - complete, repeatable DOS/crash), with only partial confidentiality and integrity impact (C:L/I:L). No EPSS score was supplied in the input, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent - a genuine but not easily weaponized issue - rather than conflicting. The main realistic threat is a malicious or compromised internal/low-privilege user degrading ERP availability, not mass remote exploitation.

A low-privileged but authenticated user (or an attacker who has phished/obtained such ERP credentials) sends specially crafted traffic over the JDENET protocol to the EnterpriseOne Tools server. Because the flaw is high-complexity, the attacker must satisfy specific timing or state conditions, after which they can hang or repeatedly crash the service (complete DOS) and perform limited unauthorized reads and writes to accessible data. No public proof-of-concept is referenced.