CVE-2026-87177

A high-severity (CVSS 8.5) vulnerability exists in the Security component of Oracle Hyperion Financial Management version 11.2.26.0.000. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, and because the scope changes, successful attacks may significantly impact products beyond Hyperion Financial Management itself. Exploitation can yield unauthorized access to critical data or complete access to all Hyperion Financial Management accessible data, plus unauthorized update, insert, or delete access to some of that data, with high confidentiality and low integrity impact and no availability impact. Organizations running the affected on-premises release are at risk, particularly where HFM web endpoints are reachable by broad internal user populations or exposed to the internet. No public proof-of-concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is currently unknown/none known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw to move off Hyperion Financial Management 11.2.26.0.000. Restrict network access to HFM HTTP endpoints via firewalls and reverse proxies so only necessary finance users and systems can reach them, and enforce least-privilege account roles. Review HFM audit logs for anomalous data reads or modifications by low-privileged accounts and rotate credentials for accounts with HFM access.