Oracle JD Edwards EnterpriseOne Tools CVE-2026-87330

Exploitation requires the attacker to already have high-privileged logon access (PR:H) to the UNIX infrastructure on which JD Edwards EnterpriseOne Tools executes, specifically interacting with the 'E1 Dev Platform Tech - UNIX' component; only supported versions 9.2.0.0 through 9.2.26.5 are affected. The decisive limiting factors are the local attack vector (no network/remote path) and the high-privilege prerequisite, which together confine exploitation to insiders or attackers who have already compromised a privileged account on the host - substantially reducing real-world risk despite the 'easily exploitable' (AC:L) characterization. No end-user interaction is required (UI:N), and impact is partial for confidentiality, integrity, and availability.

This is a genuinely low-priority, low-real-risk issue despite being a vulnerability in widely-deployed ERP software. The CVSS 3.1 base score is only 4.2 (Medium), and the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L is the dominant signal: exploitation requires local logon access to the infrastructure where JD Edwards EnterpriseOne Tools runs (AV:L) AND already-high privileges on that host (PR:H). An attacker who already holds high privileges on the server derives limited additional value, and all three impacts are only Low (C:L/I:L/A:L - partial read, partial write/delete, and partial DOS). There is no CISA KEV listing, no POC/exploit-code reported in the provided intelligence, and no EPSS score supplied - so by the precision rules this is 'no public exploit identified at time of analysis.' No signals conflict: the low CVSS, absence of KEV, and absence of POC all point the same direction. The only mild caveat is that the Oracle description calls it 'Easily exploitable,' which maps to AC:L but does NOT lower the PR:H local-access barrier. CWE is listed as N/A and no EPSS was provided, so automatable/exploitation-likelihood cannot be quantified beyond the vector. Overall: patch in the normal Oracle CPU cycle, not an emergency.

An attacker who has already obtained a high-privileged local account on the UNIX host running JD Edwards EnterpriseOne Tools (e.g., a rogue administrator or an intruder who escalated through a separate flaw) abuses the E1 Dev Platform Tech component to read a subset of EnterpriseOne data and perform limited unauthorized updates/inserts/deletes, and can cause a partial denial of service. No public exploit code is identified at time of analysis, and because the attack vector is local with high privileges required, there is no remote or unauthenticated path.