CVE-2026-87195

A difficult-to-exploit vulnerability in the Security component of Oracle Hyperion Financial Management allows an unauthenticated attacker with network access via TLS to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification of critical data or all HFM-accessible data, as well as unauthorized read access to critical data, giving high confidentiality and integrity impact (CVSS 3.1: 7.4, availability unaffected). Only version 11.2.26.0.000 is listed as affected. The high attack complexity means reliable exploitation requires favorable conditions, but no authentication or user interaction is needed, so internet-reachable instances remain at risk. There is no known public proof of concept and no evidence of exploitation in the wild.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87195 to move off affected version 11.2.26.0.000. Restrict network access to Hyperion Financial Management TLS endpoints (VPN or IP allowlisting) and ensure the service is not exposed to the internet. Review HFM audit and application logs for unexplained data creation, modification, or deletion by unauthenticated sessions.