CVE-2026-87178

Oracle Hyperion Financial Management version 11.2.26.0.000 contains a vulnerability in its Security component that is easily exploitable by a high-privileged attacker with network access via SQL. Successful exploitation allows the attacker to create, delete, or modify critical data — or all data accessible to Hyperion Financial Management — as well as gain unauthorized read access to that data, with confidentiality and integrity both highly impacted (CVSS 8.7). Because of a scope change, successful attacks on this flaw can also significantly impact additional products beyond Hyperion Financial Management itself. The affected population is organizations running the affected 11.2.26 release of this enterprise financial consolidation application, typically large finance departments with on-premises deployments. There is no known public proof of concept and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw and move off the affected 11.2.26.0.000 release to a patched version. Restrict SQL-level and network access to Hyperion Financial Management back-end databases to only trusted administrative accounts and hosts, apply least-privilege to database roles, and monitor for unexpected data modification or privilege escalation activity by high-privileged accounts.