CVE-2026-87159

A high-severity (CVSS 8.1) authorization flaw in the Internal Operations component of Oracle HRMS (India), part of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to compromise the product. Exploitation is described by Oracle as easy: a valid low-privilege account sends crafted requests over the network, with no user interaction required. A successful attack yields unauthorized creation, deletion, or modification of critical data, as well as full read access to all data accessible to Oracle HRMS (India) — potentially sensitive payroll, personnel, and localization data. Organizations running E-Business Suite release 12.2.3 through 12.2.15 with the India HRMS localization are affected. No public proof-of-concept exists and the flaw is not on the CISA KEV catalog, so exploitation in the wild is not currently indicated.

What to do: Apply Oracle's Critical Patch Update containing the fix for CVE-2026-87159 to all E-Business Suite 12.2.3-12.2.15 environments running HRMS (India). Restrict HTTP access to EBS so the self-service and HRMS modules are not reachable from untrusted networks, and enforce least-privilege roles for EBS user accounts. Review audit logs for unexpected data changes or record access by low-privilege accounts in the HRMS (India) schemas.