Description
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (India) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and modification
Action: Immediate Patch
AI Analysis

Impact

An Oracle HRMS (India) vulnerability permits a low‑privileged attacker with network access over HTTP to create, delete, or modify critical data, as well as to read all accessible data. This issue stems from misconfigured access control (CWE‑284). The CVSS v3.1 base score of 8.1 indicates high confidentiality and integrity impact with no availability impact.

Affected Systems

The flaw exists in Oracle HRMS (India) component of Oracle E‑Business Suite for supported releases 12.2.3 through 12.2.15. These versions are vulnerable to the described misuse of administration functions.

Risk and Exploitability

The CVSS score of 8.1 reflects a serious risk, yet the EPSS probability of exploitation is below 1%, suggesting low current threat activity. The vulnerability is not catalogued in the CISA KEV list. The attack requires only network connectivity to the HTTP interface and a low‑privileged account, implying that networks with exposure to Oracle HRMS (India) may be susceptible.

Generated by OpenCVE AI on September 21, 2026 at 03:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s security patch or upgrade to a version that no longer includes Oracle HRMS (India) releases 12.2.3–12.2.15.
  • Limit HTTP exposure for Oracle HRMS (India) by configuring firewall rules or a reverse proxy to allow traffic only from trusted networks.
  • Enforce the principle of least privilege for all Oracle HRMS (India) users and regularly audit account activity for unauthorized access attempts.

Generated by OpenCVE AI on September 21, 2026 at 03:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Access Enables Unauthorized Data Manipulation in Oracle HRMS (India)

Mon, 21 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Unauthorized Data Access in Oracle HRMS (India)
Weaknesses CWE-269

Mon, 21 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Unauthorized Data Access in Oracle HRMS (India)
Weaknesses CWE-269

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Oracle HRMS (India) Unauthorized Data Access Vulnerability via HTTP
Weaknesses CWE-284

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Title Oracle HRMS (India) Unauthorized Data Access Vulnerability via HTTP
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HRMS (India) accessible data as well as unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-20T23:53:13.673Z

Reserved: 2026-09-08T21:49:12.399Z

Link: CVE-2026-87159

cve-icon Vulnrichment

Updated: 2026-09-20T23:45:39.215Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:19:03.447

Modified: 2026-09-21T00:16:58.713

Link: CVE-2026-87159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T04:00:13Z

Weaknesses