CVE-2026-87197

A vulnerability in the Security component of Oracle Hyperion Financial Management allows an unauthenticated attacker with network access via HTTP to compromise the application. Exploitation requires no privileges, no user interaction, and is rated easy (CVSS 3.1 base score 8.2). A successful attack can result in unauthorized read access to critical data or all Oracle Hyperion Financial Management accessible data, as well as unauthorized update, insert, or delete access to some of that data; availability is not impacted. Only supported version 11.2.26.0.000 is listed as affected. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no active exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to Oracle Hyperion Financial Management 11.2.26.0.000 as soon as it is available. Restrict HTTP access to HFM services to trusted internal networks or VPN, and avoid exposing them directly to the internet. Review application and access logs for unauthenticated requests to HFM endpoints and any unexpected data reads or modifications.