CVE-2026-87124: Oracle iRecruitment Auth Bypass Vulnerability

CVE-2026-87124 Overview

CVE-2026-87124 is a vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle iRecruitment. Although the vulnerability resides in iRecruitment, successful exploitation produces a scope change that impacts additional Oracle products. The confidentiality impact allows unauthorized access to critical data or complete access to all data accessible through iRecruitment.

Critical Impact
A low-privileged network attacker can gain unauthorized access to critical data across Oracle iRecruitment and adjacent products through a scope-changing exploit over HTTP.

Affected Products

Oracle E-Business Suite - Oracle iRecruitment version 12.2.3
Oracle E-Business Suite - Oracle iRecruitment versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle iRecruitment version 12.2.15

Discovery Timeline

2026-09-15 - CVE CVE-2026-87124 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87124

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle iRecruitment within Oracle E-Business Suite. Oracle iRecruitment is the recruiting module used to publish job postings, capture applications, and manage candidate data. Because the module handles applicant records, background information, and internal hiring workflows, unauthorized read access exposes sensitive personal and organizational data.

The issue is classified as an Information Disclosure vulnerability with a scope change. A scope change indicates the vulnerable component grants access to resources managed by other Oracle products, extending exposure beyond iRecruitment itself. Exploitation requires only low privileges and no user interaction, and it can be performed over the network via HTTP.

Root Cause

Oracle has not published root-cause details in the public advisory. The Critical Patch Update classifies the flaw under Information Disclosure with confidentiality-only impact, indicating that authorization or access-control enforcement on iRecruitment resources is bypassed or improperly scoped between the module and adjacent E-Business Suite components. See the Oracle Security Alert for the vendor's authoritative bulletin.

Attack Vector

An authenticated attacker with a low-privileged account, such as a standard applicant or internal user role, sends crafted HTTP requests to the iRecruitment application. The requests target Internal Operations endpoints that fail to enforce authorization boundaries. Successful requests return sensitive data from iRecruitment and, due to the scope change, from other Oracle E-Business Suite components accessible to the compromised session.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert for technical details as Oracle releases them.

Detection Methods for CVE-2026-87124

Indicators of Compromise

Unusual HTTP requests from low-privileged iRecruitment user sessions to Internal Operations endpoints or administrative URL paths.
Bulk retrieval of applicant records, resumes, or internal personnel data by accounts without a business need for such access.
Session activity that crosses product boundaries within Oracle E-Business Suite from an iRecruitment-scoped identity.

Detection Strategies

Review Oracle E-Business Suite application logs and web-tier access logs for anomalous URL patterns targeting iRecruitment Internal Operations pages.
Baseline typical iRecruitment usage per role and alert on deviations, such as sudden data-export volumes or off-hours access from standard user accounts.
Correlate authentication events with data-access records in a centralized analytics platform to surface cross-module access originating from iRecruitment sessions.

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and E-Business Suite audit logs to a centralized SIEM for long-term retention and query.
Enable Fine-Grained Auditing (FGA) on sensitive HR and iRecruitment tables to record read access by low-privileged users.
Track and alert on privilege changes and responsibility assignments granting iRecruitment access.

How to Mitigate CVE-2026-87124

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update referenced in the Oracle Security Alert to all Oracle E-Business Suite instances running iRecruitment 12.2.3 through 12.2.15.
Inventory all internet-facing iRecruitment deployments and prioritize patching for those reachable over public HTTP.
Audit iRecruitment user accounts and remove or disable stale, unused, or over-privileged accounts.

Patch Information

Oracle addresses this vulnerability in the Critical Patch Update documented in the Oracle Security Alert. Administrators must apply the patch bundle appropriate for their Oracle E-Business Suite 12.2.x release level. Follow Oracle's documented patching procedure, including running AutoConfig and clearing middle-tier caches after installation.

Workarounds

Restrict network access to iRecruitment Internal Operations endpoints using a web application firewall or reverse-proxy allow-list until patching is complete.
Enforce strong authentication and reduce the number of accounts granted iRecruitment responsibilities.
Place the iRecruitment application tier behind VPN or IP-based access controls where the module is not required to be internet-facing.

bash

# Example: restrict iRecruitment URLs at the reverse proxy
# Consult Oracle documentation before applying in production
Location /OA_HTML/OA.jsp {
    allow 10.0.0.0/8;
    deny  all;
}