## Summary
A vulnerability in Oracle HRMS (India) (component: Internal Operations) within Oracle E-Business Suite allows a low-privileged attacker with network access via HTTP to compromise the application. Supported affected versions are 12.2.3 through 12.2.15.
Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data and/or unauthorized access to all Oracle HRMS (India) accessible data.
## Technical Details
- Attack vector: NETWORK via HTTP
- Required privileges: PR:L (low privileged attacker)
- User interaction: UI:N (no user interaction)
- Complexity: AC:L (easily exploitable)
- Impact scope: S:U
- CVSS 3.1: 8.1 with C:H and I:H (high confidentiality and integrity impact)
## Affected
- Oracle E-Business Suite — Oracle HRMS (India) (Internal Operations)
- Affected versions: 12.2.3 to 12.2.15
## Impact
- Unauthorized creation, deletion, or modification of critical data
- Unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data
- Availability impact is not indicated as affected (A:N in the provided vector)
## Mitigation
1. Patch immediately: apply the vendor’s security fix for CVE-2026-87159 for Oracle E-Business Suite / Oracle HRMS (India) Internal Operations.
2. Restrict network exposure: limit inbound HTTP access to the HRMS (India) application endpoints to only trusted sources.
3. Reduce privileges: ensure the lowest possible privileges for any accounts that could be used as the PR:L foothold.
4. Monitor for suspicious data changes and access patterns consistent with unauthorized create/delete/modify activity and abnormal reads of HRMS (India) data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N