CVE-2026-87201

CVE-2026-87201 is a vulnerability in the Security component of Oracle Hyperion Financial Management, a enterprise financial consolidation and close application. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, who can escalate to a full compromise of the Oracle Hyperion Financial Management instance, with high impact on confidentiality, integrity, and availability. Only the supported version 11.2.26.0.000 is listed as affected. Successful exploitation effectively hands the attacker takeover of the application and its financial data. There is no evidence of exploitation in the wild and no public proof of concept is known, but the vulnerability carries a high CVSS 3.1 base score of 8.8.

What to do: Apply the Oracle Critical Patch Update (CPU) that remedies CVE-2026-87201 to any Hyperion Financial Management instance running 11.2.26.0.000 as soon as it is available. Restrict network access to Hyperion HTTP endpoints (e.g., via VPN, IP allowlisting, or reverse proxy with authentication) and enforce least-privilege role assignments. Review audit and access logs for anomalous activity by low-privileged accounts that could indicate an attempted exploitation.