CVE-2026-87160 is a vulnerability affecting Oracle HRMS (India) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access over HTTPS to compromise the system, resulting in unauthorized access to critical data and the ability to update, insert, or delete some accessible data. The CVSS 3.1 score is 7.1, with attack vector network, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to critical data within Oracle HRMS (India) and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate this vulnerability. No additional vendor advisory states that no action is required or that the issue is already mitigated.