CVE-2026-87205

CVE-2026-87205 is a vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), part of Oracle's Enterprise Performance Management suite, affecting supported version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. Successful exploitation allows unauthorized access to critical data or complete read access to all data accessible to the HFM application; the CVSS 3.1 base score is 7.5 with high confidentiality impact only (no integrity or availability impact). Organizations running the affected on-premises version are exposed, particularly if HFM HTTP endpoints are reachable beyond trusted internal networks. No public proof-of-concept exists and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply Oracle's latest Critical Patch Update for Hyperion Financial Management 11.2.x to remediate this flaw in the Security component of version 11.2.26.0.000. Restrict HTTP access to HFM endpoints so they are reachable only from trusted internal networks or VPNs rather than the internet. Review access logs for unauthenticated requests to the Security component and verify no unauthorized data access has occurred.