JD Edwards EnterpriseOne CVE-2026-87329

Exploitation requires the attacker to already possess a low-privileged account with interactive logon to the server infrastructure where JD Edwards EnterpriseOne Tools executes (local attack vector, PR:L) - it is not remotely exploitable over the network and requires no user interaction from a victim. Attack complexity is high (AC:H), meaning success depends on conditions outside the attacker's direct control (e.g., timing, specific state, or environmental factors), which meaningfully limits reliable exploitation. Affected deployments are JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5; the Enterprise Infrastructure SEC component must be in use. The primary limiting factors are the mandatory local access and the high complexity, which together confine realistic exploitation to insiders or attackers with an existing host foothold.

This is a moderate-priority, locally-exploitable flaw rather than a top-tier emergency. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:L/AC:H/PR:L/UI:N: exploitation requires local logon access to the host where JD Edwards EnterpriseOne Tools runs (AV:L), is difficult to pull off (AC:H), and needs a low-privileged authenticated account (PR:L). Impact is asymmetric - low confidentiality (C:L) but high integrity (I:H) and high availability (A:H), meaning an attacker can modify/delete critical data and cause a complete, repeatable DoS, while only reading a subset of data. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the local vector plus high attack complexity make opportunistic mass exploitation unlikely. The combination of AV:L and AC:H substantially lowers real-world risk below what the Medium score alone might suggest, but the high integrity/availability impact means a malicious or compromised low-privileged insider on the ERP infrastructure is a credible threat. CWE is listed as N/A and Oracle (per CPU advisory practice) does not publish a detailed root cause, so the exact vulnerability class is unconfirmed - verify specifics against the October 2026 CPU once CVSS/technical details are published.

A low-privileged user who already has a logon on the server infrastructure hosting JD Edwards EnterpriseOne Tools abuses a flaw in the Enterprise Infrastructure (SEC) component to tamper with or delete critical ERP data and crash the service. Because the attack is local (AV:L) and difficult (AC:H), it most realistically involves a malicious insider or an attacker who has already gained a foothold on the host, rather than a remote adversary. No public exploit code was identified at time of analysis.