CVE-2026-87204

CVE-2026-87204 is a high-severity (CVSS 8.8) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. It is easily exploitable by a low-privileged (authenticated) attacker with network access to the product over HTTP, requiring no user interaction. A successful attack allows the attacker to fully compromise Oracle Hyperion Financial Management, with high impact on the confidentiality, integrity, and availability of the application and its financial data. Organizations running the affected on-premises enterprise performance management release are exposed, particularly where the HFM web tier is reachable by broad internal or external user populations. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation appears limited at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87204 as soon as it is released, moving off 11.2.26.0.000 to the patched 11.2.x release. In the interim, restrict HTTP access to HFM endpoints to trusted networks and VPNs, audit and minimize low-privileged account grants, and monitor authentication and application logs for anomalous activity by low-privilege users. Verify that no HFM consoles are unintentionally exposed to the internet.