CVE-2026-87124

CVE-2026-87124 is an easily exploitable vulnerability in the Internal Operations component of Oracle iRecruitment, a recruitment/hiring module of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is triggered by a low-privileged, authenticated attacker sending requests over HTTP to the iRecruitment web tier, requiring no user interaction. Successful exploitation yields unauthorized access to critical data or complete access to all data reachable through Oracle iRecruitment, and because the vulnerability has a scope change, successful attacks may significantly impact products beyond iRecruitment itself. Organizations running E-Business Suite 12.2.3-12.2.15 with iRecruitment enabled — particularly those exposing the module to applicants or employees over the internet — are affected. No public proof of concept exists, the flaw is not on the CISA KEV list, and no exploitation has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to all E-Business Suite 12.2.3-12.2.15 environments running iRecruitment. Restrict HTTP access to iRecruitment and internal-operations pages via VPN or IP allowlisting, since only a low-privileged account (e.g., employee or applicant self-service login) is needed to exploit the flaw. Review EBS audit logs for anomalous data access by low-privilege accounts against recruitment data.