CVE-2026-87186

A critical vulnerability (CVSS 9.6) in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an unauthenticated attacker who can reach the network segment attached to the HFM hardware compromise the application with low attack complexity and no user interaction. Successful exploitation results in a complete takeover of Oracle Hyperion Financial Management, with high impacts on confidentiality, integrity, and availability. Because the vulnerability's scope changes, successful attacks may also significantly impact additional products beyond HFM itself. Organizations running the supported release 11.2.26.0.000 on their internal networks are affected. No public proof-of-concept is known and the CVE is not on the CISA Known Exploited Vulnerabilities list, so no in-the-wild exploitation has been observed.

What to do: Apply the Oracle Critical Patch Update (CPU) release that remediates CVE-2026-87186 to every Hyperion Financial Management 11.2.26.0.000 deployment as soon as the patch is available, since no fixed version is named in the advisory. In the interim, tightly restrict which hosts can reach the HFM servers by segmenting the VLAN and enforcing host-based firewall allowlists on the communication segment attached to the HFM hardware. Audit HFM and adjacent EPM logs for unexplained privileged access or configuration changes, and patch the scope-changed downstream products per Oracle's related guidance.