CVE-2026-87161: Oracle HRMS India Auth Bypass Vulnerability

CVE-2026-87161 Overview

CVE-2026-87161 is a vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the issue with low attack complexity and no user interaction. The vulnerability introduces a scope change, meaning successful exploitation can impact components beyond Oracle HRMS (India). Attackers can gain unauthorized access to critical data and perform limited unauthorized updates, inserts, or deletions on data accessible to Oracle HRMS (India).

Critical Impact
Authenticated attackers can compromise confidentiality of all HRMS-accessible data and modify a subset of records across a wider scope than the vulnerable component.

Affected Products

Oracle E-Business Suite - Oracle HRMS (India) version 12.2.3
Oracle E-Business Suite - Oracle HRMS (India) versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle HRMS (India) version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87161 published to the National Vulnerability Database (NVD)
2026-09-16 - CVE-2026-87161 last updated in NVD database

Technical Details for CVE-2026-87161

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle HRMS (India), part of Oracle E-Business Suite. An attacker holding a low-privilege application account can send crafted HTTP requests to the vulnerable interface. Because the exploit path crosses a security boundary, impacts extend beyond the HRMS module into other Oracle E-Business Suite components. Successful exploitation exposes sensitive human resources data, including employee, payroll, and organizational records. Attackers can additionally modify a subset of records reachable through the HRMS (India) module. Oracle has published remediation guidance in the Oracle Security Alert CSPUSEP2026.

Root Cause

Oracle has not disclosed a public technical root-cause analysis or CWE mapping for CVE-2026-87161. Based on the advisory, the flaw permits an authenticated actor to trigger operations that should be restricted by access control. The scope change indicated by the CVSS vector suggests the vulnerable code path breaches the security authority that owns the HRMS (India) resources, allowing downstream systems to trust attacker-influenced data.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. No user interaction is required. The attacker submits crafted requests to the Internal Operations component. Given the scope change, an attacker can pivot from limited HRMS access to broader data exposure across the Oracle E-Business Suite deployment. The Exploit Prediction Scoring System (EPSS) currently rates this issue at the lower end of near-term exploitation likelihood, and no public exploit code has been observed. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative details.

Detection Methods for CVE-2026-87161

Indicators of Compromise

Unexpected HTTP requests from low-privileged HRMS user sessions targeting Internal Operations endpoints of Oracle E-Business Suite
Application audit records showing reads or writes to HRMS (India) data by accounts that do not normally interact with those modules
Anomalous outbound data transfers or bulk exports from Oracle E-Business Suite servers hosting the HRMS (India) module

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and application-level logging for the HRMS (India) Internal Operations component
Baseline normal HTTP request patterns to Oracle E-Business Suite and alert on deviations by user, URL, or response size
Correlate database audit records with web-tier logs to identify authenticated users performing unauthorized data reads or modifications

Monitoring Recommendations

Forward Oracle E-Business Suite web-tier, concurrent manager, and database audit logs to a centralized analytics platform for continuous review
Monitor privileged and low-privileged HRMS accounts for behavioral drift, including new source IPs, off-hours activity, and elevated request volumes
Track configuration changes to HRMS (India) responsibilities, menus, and function security to detect unauthorized privilege grants

How to Mitigate CVE-2026-87161

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15
Inventory user accounts with access to the HRMS (India) Internal Operations component and remove entitlements that are not required
Restrict network reachability of the Oracle E-Business Suite HTTP endpoints to trusted corporate networks and VPN users

Patch Information

Oracle released remediation guidance in Oracle Security Alert CSPUSEP2026. Administrators should follow the alert to identify the applicable patch for their Oracle E-Business Suite 12.2.x release and apply it during the next available maintenance window. Consult the Oracle Security Alert CSPUSEP2026 for supported version guidance and patch prerequisites.

Workarounds

Disable or restrict the HRMS (India) Internal Operations responsibilities and menus for users who do not require them until the patch is applied
Place a web application firewall (WAF) in front of Oracle E-Business Suite and block or alert on suspicious request patterns to the affected component
Enforce strong authentication and session controls, including multi-factor authentication, for all Oracle E-Business Suite users

bash

# Example: restrict access to Oracle E-Business Suite HTTP endpoints at the network layer
# Replace 10.0.0.0/8 with your trusted management network
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP