CVE-2026-87160: Oracle HRMS India Auth Bypass Vulnerability

CVE-2026-87160 Overview

CVE-2026-87160 is a high-severity vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTPS can exploit this flaw to compromise Oracle HRMS (India). Successful exploitation grants unauthorized read access to all Oracle HRMS (India) accessible data, along with unauthorized update, insert, or delete access to a subset of that data. Oracle disclosed the issue in its September 2026 Critical Patch Update Special Program.

Critical Impact
Authenticated network attackers can exfiltrate the full contents of Oracle HRMS (India) data and tamper with a subset of records, exposing sensitive employee and payroll information.

Affected Products

Oracle E-Business Suite — Oracle HRMS (India), version 12.2.3
Oracle E-Business Suite — Oracle HRMS (India), versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle HRMS (India), version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87160 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87160

Vulnerability Analysis

CVE-2026-87160 resides in the Internal Operations component of the Oracle HRMS (India) module within Oracle E-Business Suite. The flaw allows a low-privileged authenticated user to reach functionality that returns or modifies HRMS (India) data outside the intended authorization boundary. Because E-Business Suite exposes application services over HTTPS, exploitation only requires network reachability to the application tier and valid application credentials.

The impact profile — high confidentiality loss, low integrity loss, and no availability impact — is consistent with a broken access control or improper authorization defect in an HRMS servlet or business-service endpoint. India-specific HRMS modules typically handle payroll, statutory reporting, and employee personal data, all of which fall in scope for this issue.

Root Cause

Oracle has not published the underlying code-level root cause. Based on the disclosed impact and low privilege requirement, the vulnerability is consistent with an authorization check that fails to constrain a low-privileged HRMS user from reading records across the full HRMS (India) data set and writing to a subset of records. Refer to the Oracle Security Alert for authoritative technical details.

Attack Vector

The attack originates over the network via HTTPS against the E-Business Suite application tier. The attacker must hold a low-privileged account. No user interaction is required, and attack complexity is low. Once authenticated, the attacker issues requests to the affected Internal Operations endpoint of Oracle HRMS (India) to read or modify data beyond their assigned entitlements. No proof-of-concept exploit is publicly available at the time of publication.

No verified exploitation code is available. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-87160

Indicators of Compromise

Authenticated HTTPS requests from low-privileged HRMS accounts to Internal Operations URLs of Oracle HRMS (India) that return large volumes of employee, payroll, or statutory data.
Unexpected UPDATE, INSERT, or DELETE activity in HRMS (India) tables performed by accounts that do not normally modify HRMS records.
Access patterns to HRMS (India) endpoints originating from user sessions outside typical business hours or geographies.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify anomalous access to HRMS (India) responsibilities.
Correlate application-tier HTTPS access logs with database audit trails on HRMS (India) schemas to detect authorization boundary violations.
Baseline normal HRMS (India) transaction volumes per user and alert on statistical outliers in read or write operations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs into a centralized analytics platform for longitudinal analysis.
Monitor for privilege changes on E-Business Suite user accounts and responsibility assignments granting HRMS (India) access.
Track outbound data transfers from the E-Business Suite application tier that could indicate bulk exfiltration of HRMS records.

How to Mitigate CVE-2026-87160

Immediate Actions Required

Apply the fixes referenced in the September 2026 Oracle Critical Patch Update Special Program to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments running Oracle HRMS (India).
Inventory all E-Business Suite instances and confirm which host the HRMS (India) module, prioritizing internet-reachable or partner-connected deployments.
Review and reduce low-privileged account assignments that carry HRMS (India) responsibilities.

Patch Information

Oracle addressed CVE-2026-87160 in the September 2026 Critical Patch Update Special Program. Patch details, prerequisites, and applicability by version are documented in the Oracle Security Alert. Apply the fix to Oracle E-Business Suite versions 12.2.3 through 12.2.15 following Oracle's standard patch application process for the E-Business Suite technology stack.

Workarounds

Restrict network access to the E-Business Suite application tier so that only authenticated corporate networks or VPN clients can reach HTTPS endpoints.
Temporarily disable or restrict end-user responsibilities that expose the affected Internal Operations functionality of Oracle HRMS (India) until patching is complete.
Enforce strong authentication and session controls on E-Business Suite accounts to raise the barrier for the low-privilege prerequisite of this vulnerability.

bash

# Example: restrict application-tier HTTPS access at the perimeter
# (adapt to your firewall or reverse proxy syntax)
# Allow only trusted corporate CIDR ranges to reach the EBS app tier
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP