CVE-2026-87124
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle iRecruitment within Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data, and the attack may impact additional products (scope change).
Risk Assessment
An attacker could gain access to critical data in the recruitment system, potentially breaching information confidentiality. Scope change means effects may also impact other systems.
Recommendation
Update Oracle E-Business Suite to the latest patched version. Restrict network access to the system and monitor for unusual user activity.
Other vulnerabilities in Oracle iRecruitment
See all- CVE-2026-83491Medium
Vulnerability in Oracle iRecruitment (Internal Operations component) versions 12.2.3-12.2.15. An unauthenticated attacker with physical access to the communication segment can gain unauthorized access to critical data and modify or delete it.
- CVE-2026-83490High
Vulnerability in Oracle iRecruitment within Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data and modification, and the attack may impact additional products (scope change).
- CVE-2026-70835High
Vulnerability in Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A low-privileged attacker can gain full access to data, including critical data, and modify it via HTTP.
- CVE-2026-61026High
In Oracle iRecruitment (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, a vulnerability in the Internal Operations component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
- CVE-2026-61025High
Vulnerability in Oracle iRecruitment from Oracle E-Business Suite (component: Internal Operations). Affected versions are 12.2.3-12.2.15. A high-privileged attacker with network access via HTTP can easily exploit this vulnerability, potentially leading to full system takeover.
Original NVD description (English source)
Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. While the vulnerability is in Oracle iRecruitment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iRecruitment accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS