CVE-2026-87159 is a vulnerability in the Oracle HRMS (India) product within Oracle E-Business Suite (component: Internal Operations). It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle HRMS (India). The CVSS 3.1 score is 8.1 with high confidentiality and integrity impacts and no impact on availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 new security patches across multiple products including Oracle E-Business Suite.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle HRMS (India), or unauthorized access to all data accessible by this component. This compromises confidentiality and integrity of sensitive HRMS data. There is no reported impact on system availability. No known exploits in the wild have been reported to date.

Oracle has released an official security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the provided patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigations are indicated by the vendor advisory.