CVE-2026-87188

CVE-2026-87188 is a critical (CVSS 9.8) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction, and successful attacks result in complete takeover of the Oracle Hyperion Financial Management application with high impact to confidentiality, integrity, and availability. In practice, this means an attacker who can reach an exposed HFM web endpoint could seize control of the financial consolidation system and its data. Affected organizations are enterprises running Oracle Hyperion Financial Management 11.2.26.0.000 on-premises. No public proof-of-concept exists and the flaw is not on the CISA KEV catalog, so exploitation is not currently known to be occurring in the wild.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87188 to Hyperion Financial Management 11.2.26.0.000 as soon as it is available, since the flaw is rated critical and unauthenticated. Restrict network access so HFM HTTP endpoints are reachable only from trusted internal networks or VPN rather than the internet. Review web server and application logs for unauthenticated requests targeting the Security component to check for any suspicious access, and verify that no HFM 11.2.26.0.000 instance is unintentionally internet-facing.