CVE-2026-87190

CVE-2026-87190 is a vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting supported version 11.2.26.0.000. A remote attacker who already holds low-privileged credentials can trigger the flaw through HTTP network access to the HFM application; Oracle rates exploitation as difficult (Attack Complexity: High), but no user interaction is required. Successful attacks allow the attacker to fully compromise Oracle Hyperion Financial Management, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Organizations running on-premises HFM 11.2.26.0.000 for financial consolidation and close processes are affected. There is no known public proof of concept and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87190 to your Hyperion Financial Management 11.2.26.0.000 environment as soon as it is available. Restrict HTTP access to HFM endpoints via IP allowlisting or VPN so only finance and accounting users can reach the application, and enforce least-privilege role assignments since exploitation requires a low-privileged authenticated account. Review audit logs for anomalous activity by low-privileged accounts, such as unexpected privilege changes or administrative actions, over the past several months.