CVE-2026-87182

A vulnerability in the Security component of Oracle Hyperion Financial Management (HFM) version 11.2.26.0.000 lets a low-privileged attacker who already has logon access to the infrastructure hosting HFM fully compromise the application. The flaw is rated CVSS 3.1 8.8 with a scope change (S:C), meaning successful attacks can also significantly impact additional products running on the same infrastructure beyond HFM itself. Exploitation is described as easy and results in high impacts to confidentiality, integrity, and availability, up to complete takeover of Oracle Hyperion Financial Management. Only the supported version 11.2.26.0.000 is listed as affected. No public proof of concept exists, the issue is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild is known.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw and upgrade from HFM 11.2.26.0.000 to the patched release. Because exploitation only requires a low-privileged local account, tightly restrict and audit OS/service accounts on Hyperion hosts and enforce least privilege. Given the scope-change impact, monitor shared Hyperion infrastructure for privilege escalation or unexpected activity affecting co-resident products.