CVE-2026-87159 in HRMS
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (India) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Internal Operations component of Oracle HRMS for India, a critical module within the broader Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15, indicating that it is present in multiple recent releases and potentially impacts a significant portion of organizations relying on this specific regional configuration for their human resources management needs. The vulnerability classifies as an easily exploitable issue that requires only low-privileged access to the network via HTTP, which significantly lowers the barrier to entry for potential attackers compared to vulnerabilities requiring high privileges or complex interaction vectors.
From a technical perspective, the flaw allows an attacker with valid but limited credentials and network connectivity to manipulate critical data structures within the application. The nature of this exploitation suggests a failure in proper access control validation or input sanitization mechanisms during internal operations processing. Because the attack vector is HTTP-based, it implies that the vulnerability can be triggered remotely over standard web protocols without requiring user interaction such as clicking malicious links or opening crafted files. This characteristic aligns with common patterns found in server-side request forgery issues or insecure direct object reference flaws where the application fails to adequately verify if a low-privileged user has authorization to perform specific administrative-level data operations on behalf of higher privileged users or system processes.
The operational impact of this vulnerability is severe, as evidenced by its CVSS 3.1 Base Score of 8.1, which denotes a High severity rating. The primary impacts are categorized under Confidentiality and Integrity, with no direct effect on Availability according to the provided vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This means that successful exploitation enables an attacker to gain unauthorized access to sensitive human resources data, including personal identifiable information of employees, payroll details, and performance records. Furthermore, the ability to create, delete, or modify critical data introduces significant integrity risks. An adversary could alter employee records, manipulate salary structures, or remove essential audit trails, leading to potential financial fraud, regulatory non-compliance with laws such as GDPR or local Indian labor regulations, and severe reputational damage for the affected organization.
In terms of industry standard classifications, this vulnerability maps closely to CWE-269 Improper Privilege Management, specifically where a user is able to perform actions that exceed their assigned role permissions. It also relates to CWE-862 Missing Authorization, as the application does not properly enforce access controls for sensitive data operations. From an offensive security framework perspective, such behavior aligns with MITRE ATT&CK techniques involving Privilege Escalation and Data Exfiltration via Application Layer Protocols. The lack of user interaction requirement places it in categories associated with automated exploitation tools that can scan networks for vulnerable endpoints without needing social engineering components.
To mitigate this risk, organizations must prioritize the immediate application of Oracle-supplied security patches or updates that address the specific flaw within the Internal Operations component. Since the vulnerability affects a range of versions from 12.2.3 to 12.2.15, it is crucial for administrators to verify their current patch level and apply the latest available interim fixes provided by Oracle Support. Additionally, implementing network-level controls such as Web Application Firewalls can help detect and block anomalous HTTP requests that attempt to exploit this logic flaw before they reach the application server. Restricting access to HRMS endpoints to only authorized IP ranges or virtual private networks further reduces the attack surface. Regular security audits focusing on role-based access control configurations within Oracle E-Business Suite are also recommended to ensure that low-privileged accounts do not possess unintended capabilities for data manipulation, thereby enforcing the principle of least privilege effectively across all user roles.