Oracle HRMS (India) CVE-2026-87295

Exploitation requires the attacker to already possess a valid low-privilege logon account on the infrastructure where Oracle HRMS (India) runs (CVSS AV:L, PR:L) and access to the Indian Payroll component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15. LIMITING FACTORS: this is a local/authenticated vector, not remote or unauthenticated, so an attacker must first obtain internal credentials or a foothold; exploitation is confined to environments that have the India HRMS localization / Indian Payroll module deployed, which narrows real-world applicability to organizations running Oracle payroll for India. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the logon prerequisite is met the attack is reliable. Impact is limited to confidentiality (information disclosure); no integrity or availability impact.

This is a moderate-priority vulnerability (CVSS 3.1 base 6.5) whose risk is meaningfully constrained by its attack vector. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N shows a LOCAL attack vector (AV:L) requiring the attacker to already hold a valid low-privilege logon to the infrastructure where Oracle HRMS (India) executes (PR:L) - this is NOT a remote, unauthenticated, internet-facing flaw. Low attack complexity (AC:L) and no user interaction (UI:N) make exploitation reliable once that foothold exists. Impact is confidentiality-only (C:H, I:N, A:N) but with a scope change (S:C), meaning a successful attack can reach data in additional products beyond HRMS (India) itself, which is why a confidentiality-only issue still scores 6.5 rather than lower. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of active or probable near-term mass exploitation - this reads as a credentialed insider/post-compromise data-access risk rather than a wormable internet threat. No SSVC decision data was supplied. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS vector and description - PR:L explicitly requires the attacker to already be authenticated with a logon, so this is unauthorized data access by a low-privileged user, not an authentication bypass; verify the tag with the vendor advisory. The realistic priority is to patch in the next scheduled cycle for internal/multi-tenant EBS environments where many low-privilege accounts exist, rather than emergency out-of-band patching.

A low-privileged user who already has a valid logon to the host/infrastructure running Oracle E-Business Suite HRMS (India) - such as a self-service employee account, contractor, or compromised low-tier internal credential - abuses the Indian Payroll component to read confidential payroll and HR data they should not have access to. Because of the scope change, the attacker can pivot to read critical data belonging to additional connected products, not just HRMS (India). No public exploit code was identified at time of analysis, and no user interaction is required.