CVE-2026-87173

Oracle Hyperion Financial Management version 11.2.26.0.000 contains a critical vulnerability in its Security component that allows an unauthenticated attacker with network access via TCP to compromise the application (CVSS 3.1: 9.1). The flaw requires no privileges, no user interaction, and is rated as easily exploitable. A successful attack gives the attacker unauthorized ability to create, delete, or modify critical data — or all data accessible to Hyperion Financial Management — as well as unauthorized read access to critical data or complete read access to all accessible data. Availability is not impacted (A:N), so the risk centers on confidentiality and integrity of financial close, consolidation, and reporting data. Organizations running the affected on-premises version are exposed wherever the service is reachable over the network; no public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to move off affected version 11.2.26.0.000 as soon as it is available. Until patched, restrict TCP access to Hyperion Financial Management services at the firewall so only trusted internal clients and VPN users can reach them, and avoid any internet exposure. Review HFM audit logs for unexpected data creation, modification, or deletion and for access from unexplained sources.