Description
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access and Modification
Action: Immediate Patch
AI Analysis

Impact

The vulnerability originates in Oracle HRMS (India) internal operations, enabling a low‑privileged attacker with network access over HTTPS to read or alter sensitive employee data. The flaw creates a confidentiality breach for critical information and allows integrity violations by permitting unauthorized update or deletion of HR data.

Affected Systems

Oracle Corporation’s Oracle HRMS (India) component of Oracle E‑Business Suite, affecting versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS 3.1 base score of 7.1 classifies the weakness as high, with an attack surface limited to network traffic via HTTPS, low attack complexity, and low privilege requirements. Although the EPSS score is below 1% and the issue is not yet in CISA’s KEV catalog, the potential for significant data leakage and corruption makes it a critical concern for any organization that relies on Oracle HRMS (India).

Generated by OpenCVE AI on September 18, 2026 at 17:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle’s security alerts for the latest patch for Oracle HRMS (India) versions 12.2.3 through 12.2.15 and deploy it immediately.
  • Restrict external network access to the Oracle HRMS (India) endpoints, allowing connections only from trusted IP ranges to reduce exposure to potential attackers.
  • Implement enhanced auditing and monitoring for HR data access and modification, and enforce stringent role‑based access controls to detect and prevent unauthorized changes.

Generated by OpenCVE AI on September 18, 2026 at 17:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Enterprise HR Management System: Low‑Privilege HTTPS Vulnerability Enables Data Breach and Modification

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Title Enterprise HR Management System: Low‑Privilege HTTPS Vulnerability Enables Data Breach and Modification
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (India). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data as well as unauthorized update, insert or delete access to some of Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle hrms
CPEs cpe:2.3:a:oracle:hrms:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hrms
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Hrms
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-21T19:40:47.108Z

Reserved: 2026-09-08T21:49:12.399Z

Link: CVE-2026-87160

cve-icon Vulnrichment

Updated: 2026-09-21T19:40:32.403Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:19:03.597

Modified: 2026-09-21T20:17:38.440

Link: CVE-2026-87160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T17:15:11Z

Weaknesses