JD Edwards EnterpriseOne CVE-2026-87389

No authentication and no user interaction are required (PR:N/UI:N), and the attack is delivered remotely over HTTP (AV:N) against JD Edwards EnterpriseOne Human Resources Management 9.2. However, exploitation is explicitly rated 'difficult' (AC:H): Oracle's description and the high-complexity metric indicate the attacker must satisfy conditions outside their direct control (e.g., winning a race or depending on specific runtime/data state), so reliable exploitation is not guaranteed. Impact is further limited to unauthorized write access to only SOME HR-accessible data - no data can be read (C:N) and no availability loss occurs (A:N). Realistic risk is reduced by network segmentation of ERP systems (JD Edwards HR is rarely internet-facing) and by the partial, integrity-only consequence.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score is only 3.7 (LOW), driven entirely by a partial integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect - successful attacks only allow unauthorized update, insert, or delete of SOME accessible Human Resources data, not full compromise. The most important mitigating signal is AC:H (high attack complexity), which Oracle's own text reinforces as 'difficult to exploit,' meaning the attacker must win a race or satisfy conditions outside their control. PR:N/UI:N raise theoretical reach but are outweighed by the limited impact and high complexity. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation interest. There are no conflicting signals here: the network vector, unauthenticated access, high complexity, and low integrity-only impact are internally consistent. SSVC framing would land at exploitation=none, automatable=no (AC:H defeats reliable automation), technical impact=partial - i.e., a low-urgency 'Track' item. Patch during the normal Oracle CPU cycle rather than emergency remediation.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet- or network-reachable JD Edwards EnterpriseOne Human Resources Management 9.2 instance, exploiting a flaw that - after satisfying difficult-to-control conditions (AC:H) - permits writing to a subset of HR data. The result is unauthorized modification, insertion, or deletion of some HR records, with no data disclosure or service disruption. No public exploit code was identified at time of analysis, and the high attack complexity makes reliable, repeatable exploitation unlikely.