CVE-2026-87198

CVE-2026-87198 is a vulnerability in the Security component of Oracle Hyperion Financial Management affecting version 11.2.26.0.000. An unauthenticated remote attacker with network access via HTTP can exploit the flaw — though Oracle rates it as difficult to exploit (Attack Complexity: High) — to compromise the application. A successful attack yields unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through Oracle Hyperion Financial Management, impacting both confidentiality and integrity (CVSS 3.1 base score 7.4). Organizations running the affected on-premises version 11.2.26.0.000 are exposed, particularly where the Hyperion web tier is reachable over the network. No public proof-of-concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

What to do: Apply Oracle's Critical Patch Update that addresses this CVE to Hyperion Financial Management 11.2.26.0.000 as soon as it is available. Restrict HTTP access to the Hyperion Financial Management web tier to trusted internal networks or VPN, since the attack requires unauthenticated network access via HTTP. Review application and database audit logs for unexpected data creation, deletion, or modification activity in HFM applications.