CVE-2026-87203

CVE-2026-87203 is a difficult-to-exploit vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting only version 11.2.26.0.000. It is triggered remotely over HTTP by an attacker who already holds low-privileged, authenticated access to the HFM application. Successful exploitation allows a full takeover of the HFM installation, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5, AV:N/AC:H/PR:L/UI:N/S:U). The high attack complexity means reliable exploitation requires specialized conditions, but the payoff is complete compromise of the financial consolidation platform, so organizations running the on-premises 11.2.26.0.000 release are the affected population. There is no known public proof of concept, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE, upgrading affected 11.2.26.0.000 deployments to the patched release. Restrict HTTP access to HPM/HFM web endpoints to trusted internal networks or VPN, and enforce least-privilege application roles to limit what low-privileged accounts can reach. Review HFM and front-end web server audit logs for anomalous activity tied to low-privilege accounts interacting with security functions.