CVE-2026-87159: Oracle HRMS Auth Bypass Vulnerability

CVE-2026-87159 Overview

CVE-2026-87159 is a high-severity vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges can exploit the issue remotely over HTTP, without user interaction. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle HRMS (India) accessible data. Because Oracle HRMS handles employee personal data, payroll, and organizational records, exploitation carries substantial confidentiality and integrity risk for affected enterprises.

Critical Impact
A low-privileged remote attacker can read and modify all Oracle HRMS (India) accessible data over HTTP, compromising confidentiality and integrity of sensitive human resources records.

Affected Products

Oracle E-Business Suite — Oracle HRMS (India), version 12.2.3
Oracle E-Business Suite — Oracle HRMS (India), versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (India), version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87159 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87159

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle HRMS (India), part of Oracle E-Business Suite. Exploitation requires only a low-privileged authenticated session and network access over HTTP. Oracle's advisory indicates the attack complexity is low and no user interaction is required, which lowers the operational barrier for exploitation.

Successful exploitation grants attackers full read access to Oracle HRMS (India) accessible data and permits unauthorized creation, deletion, or modification of that data. Availability is not directly impacted, but data integrity loss in HR and payroll systems can cascade into downstream financial and compliance failures.

Oracle has not published a CWE classification for this issue, and no proof-of-concept exploit is publicly available at the time of writing. The EBS module handles country-specific HR processing for India, including payroll, statutory reporting, and employee records, making it a high-value target for insider misuse and post-compromise lateral movement.

Root Cause

Oracle's Critical Security Patch Update notes the vulnerability is easily exploitable by an authenticated attacker with low privileges over HTTP. Oracle has not disclosed the specific technical root cause. The impact profile — broad read and write access to module-accessible data by a low-privileged user — is consistent with a broken access control or authorization bypass flaw in the Internal Operations component.

Attack Vector

The attack originates from the network over HTTP. The attacker requires an authenticated session with low privileges on the Oracle E-Business Suite instance. No victim interaction is needed. Because Oracle EBS deployments frequently expose HTTP endpoints to internal user populations and, in some cases, to partner networks, the practical exposure extends beyond administrators to any account holder on the platform. Refer to the Oracle Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-87159

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle HRMS (India) tables performed by low-privileged accounts.
HTTP requests to Internal Operations endpoints originating from user accounts that do not normally interact with the module.
Anomalous bulk reads of employee, payroll, or statutory data outside of scheduled batch jobs.

Detection Strategies

Enable and review Oracle E-Business Suite audit trails (FND_LOG_MESSAGES, sign-on audit, and page access tracking) for the HRMS (India) responsibility.
Correlate application-tier HTTP access logs with database DML activity on HRMS (India) tables to identify privilege mismatches.
Alert on responsibilities and menus being invoked by users outside their assigned role scope.

Monitoring Recommendations

Ingest Oracle EBS application and database audit logs into a centralized analytics platform for cross-source correlation.
Baseline normal user access patterns to HRMS (India) modules and alert on statistical deviations.
Monitor for creation of new responsibilities, users, or role grants that could be used to sustain access post-exploitation.

How to Mitigate CVE-2026-87159

Immediate Actions Required

Apply the Oracle Critical Security Patch Update referenced in the Oracle Security Alert to all affected Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all EBS environments, including non-production copies, and prioritize internet-exposed or partner-accessible instances.
Review recent HRMS (India) audit logs for suspicious create, update, or delete activity prior to patching.

Patch Information

Oracle addresses this vulnerability in its Critical Security Patch Update. Administrators should consult the Oracle Security Alert for the specific patch identifiers applicable to their Oracle E-Business Suite 12.2.x deployment and apply the fixes following Oracle's standard EBS patching procedures.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints using firewall rules, VPN, or reverse proxy allow-lists until the patch is applied.
Review and reduce the population of accounts assigned the Oracle HRMS (India) responsibility to the minimum required.
Increase audit logging verbosity on the Internal Operations component and monitor for anomalous access pending remediation.

bash

# Example: restrict EBS HTTP listener exposure at the network edge
# Replace with your organization's allow-listed CIDR ranges
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP