CVE-2026-87160

CVE-2026-87160 is an easily exploitable broken-access-control vulnerability in the Internal Operations component of Oracle HRMS (India), a localization module of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. A remote attacker with only low-privileged (valid application user) credentials and network access over HTTPS can exploit it to gain unauthorized read access to critical data — or complete access to all Oracle HRMS (India) accessible data — as well as unauthorized update, insert, and delete access to some of that data. The flaw has no user interaction requirement and no availability impact, carrying a CVSS 3.1 base score of 7.1 (high). Organizations running E-Business Suite 12.2 with the India HRMS localization exposed to untrusted networks or with large internal user populations are at greatest risk. There is no known public proof-of-concept, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no known in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-87160 to all Oracle E-Business Suite 12.2.3-12.2.15 environments running the HRMS (India) module, prioritizing any instance reachable over the internet or by broad internal user bases. Restrict HTTPS access to EBS behind VPN/IP allowlisting and review least-privilege role assignments for low-privileged HRMS users. Finally, audit HRMS India data access and change logs for unauthorized reads or modifications that could indicate earlier exploitation.