CVE-2026-87196

Oracle Hyperion Financial Management version 11.2.26.0.000 contains an easily exploitable flaw in its Security component that lets an unauthenticated remote attacker with HTTP access to the server compromise the application. The vulnerability requires no privileges, no user interaction, and only low attack complexity, so any network-reachable HFM web front end is a viable target. Successful attacks can yield unauthorized read access to critical data — potentially all data accessible to Oracle Hyperion Financial Management — plus unauthorized update, insert, or delete access to some of that data (CVSS 3.1 base score 8.2, high confidentiality impact). Organizations running the affected on-premises version are at risk, especially where the HFM web tier is reachable from untrusted networks. No public proof-of-concept is known, the flaw is not on the CISA Known Exploited Vulnerabilities list, and there is no evidence of in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw, upgrading from Hyperion Financial Management 11.2.26.0.000 to the patched 11.2.x release. Until patched, restrict HTTP access to the HFM web tier to trusted internal networks or VPN and front it with an authenticating reverse proxy if remote access is required. Review application and access logs for unauthenticated requests and any unexpected data reads or modifications since the system was exposed.