CVE-2026-87193

A flaw in the Security component of Oracle Hyperion Financial Management allows an unauthenticated attacker with network access via HTTP to read data from the application. Oracle rates the vulnerability as easily exploitable, requiring no privileges and no user interaction, but the impact is limited to confidentiality: successful attacks can expose critical data or all HFM-accessible data, with no integrity or availability impact. Only version 11.2.26.0.000 is listed as affected. Hyperion Financial Management is an enterprise financial consolidation product deployed mainly inside large corporate finance environments, so most instances sit on internal networks, though any internet-facing deployment would be directly reachable. No public proof-of-concept exists and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE and move affected 11.2.26.0.000 installations to the patched release. Until patched, restrict HTTP access to HFM to trusted internal networks or VPN, front the deployment with an authenticated reverse proxy or SSO, and audit logs for unauthenticated requests to HFM security endpoints. Given the product holds sensitive consolidated financial data, verify that no unexplained data access has occurred.