CVE-2026-87192

CVE-2026-87192 is a vulnerability in the Security component of Oracle Hyperion Financial Management, a financial consolidation and reporting application within Oracle's Hyperion/EPM suite. A low-privileged attacker with network access via HTTP can exploit it easily (CVSS 3.1: 7.1, AV:N/AC:L/PR:L) to gain unauthorized access to critical data — potentially complete access to all data the product can reach — and to cause a partial denial of service. Exploitation requires valid low-privilege credentials, so the attacker is likely an insider or someone who has compromised an account. Only supported version 11.2.26.0.000 is listed as affected. There is no known public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87192 to Hyperion Financial Management 11.2.26.0.000 as soon as your patch cycle allows. Restrict HTTP access to HFM services to trusted internal networks and VPNs, audit low-privilege accounts for suspicious data access or unexpected session activity, and enforce least-privilege role assignments in the HFM security model.