CVE-2026-87183

CVE-2026-87183 is a vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by an attacker who already holds high privileges and can log on to the infrastructure where HFM executes, but a successful attack also requires human interaction from someone other than the attacker, implying a social-engineering or user-assisted component. If exploited, the attacker can fully compromise Oracle Hyperion Financial Management (takeover with high confidentiality, integrity, and availability impact), and because of a scope change, successful attacks may also significantly impact additional products beyond HFM. The affected population is limited to organizations running the on-premises HFM 11.2.26.0.000 release. The flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known, so there is no evidence of active exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates this issue in Hyperion Financial Management 11.2.26.0.000 as soon as Oracle releases it. Restrict and monitor local and administrative logon access to servers hosting HFM, since exploitation requires high privilege plus user interaction. Train users with access to these systems to be alert to social-engineering attempts that could supply the required human-interaction step, and review privileged account activity on HFM infrastructure for anomalies.