CVE-2026-87161

CVE-2026-87161 is a high-severity (CVSS 3.1 base 8.5) authorization flaw in the Internal Operations component of Oracle HRMS (India), part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access to the E-Business Suite instance can exploit it easily with no user interaction required. Because the vulnerability changes scope, successful attacks may significantly impact additional Oracle E-Business Suite products beyond HRMS (India), resulting in unauthorized access to critical data or complete read access to all HRMS (India)-accessible data, as well as unauthorized update, insert, or delete access to some of that data (high confidentiality impact, low integrity impact, no availability impact). Organizations running affected 12.2.3-12.2.15 deployments that include the India HRMS localization are affected. No public proof-of-concept exists and the CVE is not on the CISA KEV list, so no exploitation is currently known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87161 to all EBS 12.2.3-12.2.15 environments running the HRMS (India) localization, prioritizing internet-facing instances. Restrict HTTP access to the EBS application tier to trusted networks or VPN, and review least-privilege role assignments for low-privileged HRMS accounts. Audit EBS access logs for unexpected bulk data reads or unauthorized insert, update, and delete activity by low-privilege users.