CVE-2026-87160 in HRMS
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Internal Operations component of Oracle HRMS for India, a critical module within the broader Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect allows an attacker with low privileges and network access via HTTPS to compromise the integrity and confidentiality of the system. Unlike vulnerabilities that require user interaction or high-level administrative rights, this issue can be exploited by a relatively unprivileged actor who has established a network connection to the affected service. This lowers the barrier for entry significantly, as it does not necessitate complex social engineering tactics or physical access, relying instead on standard web-based interactions over secure transport protocols.
From a technical perspective, the vulnerability enables unauthorized data manipulation and exfiltration. Successful exploitation results in two primary categories of impact: high confidentiality loss and low integrity compromise. The attacker gains the ability to read critical organizational data that should be restricted based on role-based access controls, effectively bypassing existing security boundaries. Simultaneously, the flaw permits unauthorized updates, inserts, or deletes against specific datasets within the HRMS environment. This dual nature of the attack vector means that an adversary can not only steal sensitive employee information but also alter records such as payroll details, personal identification data, or employment status, leading to potential financial fraud and operational disruption. The CVSS 3.1 base score of 7.1 reflects these significant impacts on confidentiality and integrity while noting no direct impact on availability in the current assessment.
In terms of industry classification standards, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization depending on whether the flaw stems from a failure to enforce role-based access controls correctly during request processing. The exploitation method maps closely to MITRE ATT&CK technique T1078 Valid Accounts, specifically utilizing low-privileged legitimate credentials that have been compromised or misused due to insufficient privilege separation within the application logic. Furthermore, if the vulnerability involves SQL injection or similar input validation failures leading to data access and modification, it may also correlate with CWE-89 Improper Neutralization of Special Elements used in an SQL Command. The use of HTTPS indicates that while transport encryption protects against eavesdropping on the wire, it does not mitigate application-layer logic flaws where authenticated sessions are abused.
The operational impact of this vulnerability extends beyond immediate data theft to include long-term compliance and reputational risks for organizations relying on Oracle HRMS India. Since human resources systems contain highly sensitive personally identifiable information including social security numbers, bank account details, and performance reviews, unauthorized access constitutes a severe breach of privacy regulations such as GDPR or local Indian data protection laws. The ability to modify records introduces the risk of insider threat escalation where malicious actors can alter compensation structures or employment statuses for fraudulent purposes. For enterprises, this represents a critical gap in their security posture that could lead to significant financial penalties and loss of stakeholder trust if exploited at scale.
Mitigation strategies must prioritize immediate patching by Oracle as soon as available updates are released for the affected versions 12.2.3 through 12.2.15. In the interim, organizations should implement strict network segmentation to limit HTTPS access to this specific component only from trusted internal subnets or jump hosts with enhanced monitoring. Web Application Firewalls can be configured to detect anomalous patterns of data retrieval and modification that deviate from normal user behavior profiles for low-privileged accounts. Additionally, enforcing multi-factor authentication for all administrative and privileged HRMS users adds a layer of defense against credential theft which often precedes such exploitation. Regular audits of access logs focusing on bulk data exports or unusual update operations by non-administrative roles are essential to detect potential ongoing exploitation attempts before significant damage occurs.