JD Edwards EnterpriseOne CVE-2026-87380

Exploitation requires network reachability to the JDENET communication service of a JD Edwards EnterpriseOne Sales Order Entry 9.2 deployment, plus a valid low-privileged EnterpriseOne account (PR:L) - it is NOT unauthenticated. No user interaction, no special non-default configuration, and no local access are needed, and attack complexity is low. The practical limiting factors are: (1) the attacker must already possess or acquire low-privilege credentials, and (2) the JDENET port/service must be reachable from the attacker's position, so internet-exposed or broadly network-accessible JDENET instances are at materially higher risk than those segmented behind internal network controls. Impact is confined to confidentiality of Sales Order Entry-accessible data.

This is a moderate-priority confidentiality issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) shows network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, but impact is strictly confidentiality (C:H, I:N, A:N) - no data tampering or availability loss. Oracle's own description reinforces 'easily exploitable' for an authenticated low-privileged attacker over JDENET. However, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the risk is driven by the ease-of-exploit metrics, not by observed activity. Note a conflict in the input metadata: the 'Authentication Bypass' tag contradicts the CVSS PR:L requirement and the description's 'low privileged attacker' language, which indicate valid credentials are needed - this is not an unauthenticated bypass, so the tag appears mislabeled and should be verified. Overall: patch within a normal Oracle CPU cycle, prioritizing internet-exposed or multi-tenant EnterpriseOne deployments, but this is not a drop-everything confirmed-exploited flaw.

An attacker holding a low-privileged EnterpriseOne account (or who has obtained such credentials) connects to the JDENET service over the network and issues a crafted request against the Sales Order Entry component. Because no user interaction or high privileges are required and attack complexity is low, the attacker reads critical or all Sales Order Entry-accessible data (e.g., customer, pricing, and order information) without triggering integrity or availability effects. No public exploit code was identified at time of analysis.