CVE-2026-87172

Oracle Hyperion Financial Management version 11.2.26.0.000 contains an easily exploitable flaw in its Security component, rated CVSS 3.1 9.9 (critical). A remote attacker holding only low-privileged (authenticated) access over HTTP can exploit the flaw to fully take over the Oracle Hyperion Financial Management application, with high impact to confidentiality, integrity, and availability. The CVSS scope-change metric (S:C) indicates successful attacks may also significantly impact additional products beyond Financial Management itself. Organizations running on-premises Oracle Hyperion/EPM deployments on the affected version are exposed wherever the HFM web tier is reachable by low-privileged users. No public proof-of-concept exists, the issue is not on CISA's KEV list, and no in-the-wild exploitation is currently known.

What to do: Apply the Oracle Critical Patch Update that remediates this vulnerability and move off version 11.2.26.0.000 to the latest available patch in the 11.2.x line. Until patched, restrict HTTP access to HFM web endpoints to trusted networks or VPN, audit and minimize low-privileged HFM accounts, and monitor for unexpected privilege changes or configuration modifications. Because the CVSS scope is 'changed,' also review and harden adjacent Hyperion/EPM components sharing infrastructure, trusts, or credentials with HFM.