CVE-2026-87295 in HRMS
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (India) executes to compromise Oracle HRMS (India). While the vulnerability is in Oracle HRMS (India), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Indian Payroll component of Oracle HRMS, a critical module in Oracle E-Business Suite designed to manage payroll operations for entities operating under Indian regulatory frameworks. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this vulnerability allows an attacker with low privileges and valid logon credentials on the infrastructure hosting the Oracle HRMS application to exploit a logic or access control failure within the payroll processing mechanisms. Unlike vulnerabilities that require network-level proximity, this flaw leverages authenticated access at the application layer, indicating a potential issue in how role-based permissions are enforced during specific payroll data retrieval or modification operations. The exploitation does not require user interaction beyond initial authentication, making it particularly dangerous for environments where internal users may have varying levels of system trust but insufficient oversight on their actions within sensitive modules.
The operational impact of this vulnerability is severe due to the scope change characteristic noted in the advisory. While the technical flaw is localized to the Indian Payroll component, successful exploitation can lead to a compromise that extends beyond payroll data alone. This suggests an underlying architectural weakness or improper isolation between components, allowing lateral movement within the application ecosystem. An attacker who exploits this vulnerability gains unauthorized access to critical human resources data, including sensitive personal information such as social security numbers, bank account details, salary structures, and performance reviews for employees in India. The confidentiality impact is rated high, meaning that once exploited, an adversary can exfiltrate or view all accessible payroll records without detection by standard audit logs if logging mechanisms are not explicitly configured to monitor these specific internal API calls or database queries associated with the flaw.
From a classification perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization, as it involves an authenticated user performing actions that exceed their intended privileges within the context of sensitive data access. In terms of adversary behavior mapping to MITRE ATT&CK, this scenario corresponds to techniques under the Initial Access and Credential Access tactics, specifically leveraging valid credentials to move laterally or escalate privileges within a trusted environment. The attack vector is classified as Local with Low Complexity in CVSS 3.1 terminology, which reflects that while physical or network proximity might be required for initial logon, the exploitation steps themselves are straightforward once inside the perimeter. The Scope Change indicator confirms that the vulnerability affects resources beyond the vulnerable component, increasing the overall risk profile significantly compared to isolated local flaws.
Mitigation strategies must prioritize immediate patching of all affected Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with the latest security patches provided by Oracle for the Indian Payroll module. Organizations should also implement strict role-based access control reviews to ensure that users with low-level privileges do not have unnecessary access to payroll processing interfaces or underlying database tables associated with sensitive employee data. Network segmentation and micro-segmentation can help limit lateral movement if an attacker does gain initial foothold, ensuring that compromise of the HRMS infrastructure does not automatically grant access to other critical business systems. Additionally, enhancing audit logging capabilities to specifically monitor queries related to payroll data retrieval by low-privileged accounts will aid in early detection of exploitation attempts. Regular vulnerability assessments and penetration testing focused on internal application logic flaws are essential to identify similar misconfigurations before they can be leveraged for unauthorized data access.