CVE-2026-87180

CVE-2026-87180 is a high-severity (CVSS 8.8) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by an attacker who already has a low-privileged account and network access to the product over HTTP, requiring no user interaction. A successful attack allows the attacker to fully compromise Oracle Hyperion Financial Management, with high impact on the confidentiality, integrity, and availability of the application and its financial data. Organizations running the affected 11.2.26.0.000 release of Hyperion Financial Management are exposed, particularly where the web tier is reachable by broad internal user populations or the internet. There is no evidence of in-the-wild exploitation and no public proof-of-concept is known, though the low complexity and high impact make patching a priority.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87180 and move off 11.2.26.0.000 to the latest patched 11.2.x release. Restrict HTTP access to Hyperion Financial Management web endpoints to trusted networks or VPN, and enforce least privilege on user accounts. Review audit logs for anomalous activity by low-privileged accounts, such as unexpected privilege changes or access to consolidation data, and rotate credentials for service and administrative accounts.