EnterpriseOne Tools CVE-2026-87328

Exploitation requires network reachability of the JD Edwards EnterpriseOne Tools JDENET communication service (the proprietary network transport between EnterpriseOne clients, kernels, and servers); no authentication is needed (PR:N). The principal limiting factor is the AC:H / 'Difficult to exploit' rating: the attacker must overcome non-trivial, attacker-independent preconditions (such as specific protocol state, timing, or configuration) that Oracle does not enumerate. Exposure is further bounded to supported Tools releases 9.2.0.0 through 9.2.26.5, and to confidentiality impact only - no integrity or availability compromise is possible. Defenders can materially reduce risk by restricting JDENET port exposure to trusted internal networks rather than exposing it broadly.

This is a moderate-severity confidentiality issue (CVSS 3.1 base 5.9) whose real-world risk is tempered by its high attack complexity. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-reachable, unauthenticated exploitation via the JDENET protocol, but AC:H means Oracle itself characterizes this as 'Difficult to exploit' - the attacker must win a race, meet specific timing/state conditions, or overcome non-trivial preconditions not described in the advisory. Impact is confined to confidentiality (C:H, I:N, A:N): successful attacks yield unauthorized read access up to all data accessible to JD Edwards EnterpriseOne Tools, with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or imminent exploitation; this reads as a high-CVSS-relative-to-impact but not high-urgency issue. The combination AV:N + PR:N + AC:H is internally consistent (remote, no auth, but hard), so no conflict between the vector and description is apparent. Note the 'Authentication Bypass' tag sits uneasily with a C:H/I:N/A:N (read-only) outcome, which looks more like unauthenticated information disclosure than a classic auth bypass - treat that tag with caution. CWE is N/A, so the precise weakness class is unconfirmed.

A remote attacker with no credentials sends specially crafted traffic to an internet- or network-reachable JDENET service endpoint of JD Edwards EnterpriseOne Tools and, after meeting the difficult timing or state preconditions implied by AC:H, reads sensitive business data they are not authorized to see. Because impact is confidentiality-only, the goal is data exfiltration rather than system takeover or disruption. No public exploit code is identified in the provided intelligence, so exploitation would require independent development against the proprietary JDENET protocol.