CVE-2026-87171

CVE-2026-87171 is a difficult-to-exploit, unauthenticated vulnerability in the Security component of Oracle Hyperion Financial Management (HFM) 11.2.26.0.000, reachable by a remote attacker over HTTPS with no privileges or user interaction. Successful exploitation lets the attacker create, delete, or modify critical data — or gain read access to all data accessible through HFM — and because the vulnerability changes scope, successful attacks may also significantly impact products beyond HFM itself. Organizations running the affected on-premises release are exposed wherever the HFM web tier is network-reachable, though exploitation requires overcoming high attack complexity and no public proof-of-concept or in-the-wild exploitation is known. The flaw carries a CVSS 3.1 base score of 8.7 (high), driven by full confidentiality and integrity impact with no availability impact.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87171 and confirm the fixed 11.2.26.x build in the corresponding Oracle advisory, as no fixed version is listed here. Restrict HTTPS access to HFM to VPN or internal networks and enforce authentication/MFA at the reverse proxy, since the flaw requires no credentials. Review HFM application and security logs for unexpected unauthenticated requests and any unauthorized creation, deletion, or modification of financial data, and check adjacent Hyperion products for follow-on impact given the scope change.