CVE-2026-87189

CVE-2026-87189 is a critical (CVSS 9.1) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by a high-privileged attacker who has network access to the product via Oracle Net, meaning exploitation requires an authenticated and already-privileged account rather than anonymous access. Successful attacks result in a complete takeover of Oracle Hyperion Financial Management, with high impacts to confidentiality, integrity, and availability, and because of a scope change the blast radius can extend beyond HFM to additional products in the environment. Organizations running on-premises Oracle Hyperion Financial Management 11.2.26.0.000 are affected. There is no known public proof-of-concept, the CVE is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this issue and move off 11.2.26.0.000 to the latest patched 11.2.x release as soon as it is available for your environment. Restrict Oracle Net listener and HFM service ports to trusted management networks via segmentation and firewall rules, since the attack path requires network access via Oracle Net. Audit and tightly control privileged HFM accounts, and review logs for anomalous activity by high-privilege users given the takeover and cross-product scope-change risk.