CVE-2026-87175

CVE-2026-87175 is a critical (CVSS 9.1) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting the supported version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker who has network access to the HFM server over TCP, requiring no privileges or user interaction. A successful attack allows the attacker to gain unauthorized creation, deletion, or modification access to critical data — or all data accessible to Oracle Hyperion Financial Management — as well as unauthorized read access to that data, with high confidentiality and integrity impact (availability is not affected). Organizations running HFM 11.2.26.0.000 for financial consolidation and close processes are affected, particularly if the service is reachable from untrusted network segments. No public proof of concept is known, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and there is no indication of in-the-wild exploitation to date.

What to do: Apply the fix Oracle ships in the Critical Patch Update that covers CVE-2026-87175 for Hyperion Financial Management 11.2.26, and verify you are not still running 11.2.26.0.000. Until patched, restrict TCP access to HFM application and service ports to trusted internal networks, management subnets, or VPN clients, and block exposure at perimeter firewalls or reverse proxies. Review HFM audit and application logs for unexpected data creation, modification, or deletion and for anomalous unauthenticated requests.