CVE-2026-87200

CVE-2026-87200 is a vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting supported version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack allows the attacker to create, delete, or modify critical data — or all data accessible to HFM — and to cause a partial denial of service; there is no confidentiality impact (CVSS 3.1: 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). Organizations running the affected release of HFM, typically large-enterprise finance departments, are impacted. The flaw is not in the CISA KEV catalog, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update release that addresses this CVE to all Hyperion Financial Management 11.2.26.0.000 installations. In the interim, restrict HTTP access to HFM endpoints via firewall rules or a reverse proxy so only trusted finance-network users and VPN clients can reach them. Review HFM data and audit logs for unauthorized creations, deletions, or modifications that could indicate prior tampering.