JD Edwards EnterpriseOne CVE-2026-87384

Exploitation requires network reachability to the JD Edwards EnterpriseOne JDENET communication service and a valid low-privileged JD Edwards account (PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated low-trust user with JDENET access to the Human Resources Management component of version 9.2 can attempt it. Limiting factors: the attacker must already possess credentials, impact is confined to 'some' HR-accessible data (partial integrity) and a partial rather than full denial of service, and exposure depends on how broadly the JDENET port is reachable. Organizations that restrict JDENET to trusted administrative networks and tightly control low-privilege accounts substantially reduce realistic risk.

This is a moderate-severity (CVSS 3.1 base 5.4), not a top-priority, vulnerability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) describes a network-reachable, low-complexity flaw in the Oracle JD Edwards EnterpriseOne JDENET service that requires an already-authenticated low-privileged account (PR:L) and yields only partial integrity impact (I:L - some unauthorized update/insert/delete) and partial availability impact (A:L - partial DoS), with no confidentiality impact (C:N). No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of signals points to a limited-scope, authenticated issue rather than a wormable or mass-exploited one: the PR:L requirement and partial (rather than full) impacts materially constrain real-world severity. No signals conflict - the single Oracle CPU reference, the CVSS vector, and the description are mutually consistent. The main residual uncertainty is the absence of EPSS/KEV/POC data, which is an absence of signal rather than a contradiction. Priority should be standard patch-cycle remediation driven by the Oracle October 2026 CPU, elevated only where the JDENET service is exposed to large numbers of low-trust internal users.

A low-privileged user who already holds valid JD Edwards EnterpriseOne credentials sends crafted requests over the network to the JDENET service for the Human Resources Management component. By abusing the flaw they perform unauthorized modification or deletion of some HR data and can trigger a partial denial of service of the HR module. No proof-of-concept or active exploitation is referenced in the available data.