JD Edwards EnterpriseOne CVE-2026-87388

Exploitation requires the attacker to already possess a valid low-privileged account on JD Edwards EnterpriseOne Configurator (PR:L) and network HTTP access to the Configuration Management component; only version 9.2 is listed as affected. Exploitation is further LIMITED by HIGH attack complexity (AC:H), meaning the attacker must overcome conditions outside their direct control (such as specific application state, race conditions, or non-default prerequisites) rather than firing a single reliable request. No user interaction is required (UI:N), and impact is bounded to integrity - attackers can alter or delete data but gain no read access or ability to crash the service.

This is a moderate-severity, low-priority issue despite being network-reachable. The CVSS 3.1 base score is 5.3 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N - network attack vector over HTTP, but HIGH attack complexity and requiring LOW privileges (an authenticated account). Impact is limited strictly to integrity (I:H), with no confidentiality or availability effect, meaning an attacker can create, delete, or modify data but cannot read it or disrupt service. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. The combination of high complexity plus required authentication plus integrity-only impact makes this a routine patch-cycle item rather than an emergency. One conflicting signal to note: the input Tags include 'Authentication Bypass,' which contradicts the CVSS vector (PR:L requires valid low-privilege authentication) and the description's own wording of a 'low privileged attacker' - this tag appears mislabeled and should not drive prioritization.

An attacker who already holds a low-privileged application account on JD Edwards EnterpriseOne Configurator crafts and sends malicious HTTP requests to the Configuration Management component, exploiting the flaw to tamper with configuration data they should not be able to alter. Because attack complexity is HIGH, success depends on specific conditions or timing beyond the attacker's direct control, and the impact is confined to unauthorized creation, deletion, or modification of data. No public exploit code was identified at time of analysis.