CVE-2026-87202

CVE-2026-87202 is a high-severity (CVSS 8.8) SQL injection flaw in the Security component of Oracle Hyperion Financial Management, affecting version 11.2.26.0.000. A low-privileged authenticated attacker with network access to the product's SQL interface can exploit it without user interaction to fully compromise Oracle Hyperion Financial Management, with high impact on confidentiality, integrity, and availability — effectively a complete takeover of the application. Organizations running the affected on-premises EPM/financial consolidation deployment are exposed, particularly those with broad internal network access or accounts held by many finance users. The vulnerability is described by Oracle as easily exploitable, but it is not currently listed in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known. Exploitation requires valid (low-privileged) credentials, which limits opportunistic external attacks but makes insider and credential-based threats realistic.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to Hyperion Financial Management 11.2.26.0.000 as soon as it is available, as Oracle does not issue standalone fixes outside its CPU cycle. Until patched, restrict network and SQL access to the HFM environment to only trusted users and segments, and audit low-privileged accounts for unexpected privilege changes, unauthorized account creation, or anomalous SQL activity indicative of exploitation.