CVE-2026-87185

Oracle Hyperion Financial Management version 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with network access via HTTP to escalate to full compromise of the application. Exploitation is rated easy (low attack complexity, no user interaction) and requires only a valid low-privilege account plus reachability of the Hyperion web tier. A successful attack results in complete takeover of Oracle Hyperion Financial Management, with high impact on the confidentiality, integrity, and availability of financial close and consolidation data (CVSS 3.1 base score 8.8). Only the supported release 11.2.26.0.000 is listed as affected. There is no known public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not on CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87185 to every Oracle Hyperion Financial Management 11.2.26.0.000 installation. Restrict HTTP access to the Hyperion web tier to trusted internal networks or VPN, tightly control which users hold even low-privileged accounts, and audit existing low-privilege account activity for anomalous access to administrative functions or sensitive financial data.