CVE-2026-87206

CVE-2026-87206 is a vulnerability in the Security component of Oracle Hyperion Financial Management, affecting the supported release 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the product, though the CVSS vector (AC:H) indicates exploitation is difficult. A successful attack can give the attacker unauthorized ability to create, delete, or modify critical data — or all data accessible through Hyperion Financial Management — as well as unauthorized read access to that data, with high confidentiality and integrity impact (no availability impact). Organizations running HFM 11.2.26.0.000 with web-facing or broadly reachable HTTP endpoints are the ones at risk, though the difficulty of exploitation lowers practical risk. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the flaw is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-87206 and move Hyperion Financial Management off 11.2.26.0.000 to the patched release. Restrict HTTP access to HFM web endpoints to trusted internal networks or VPN rather than exposing them broadly, since the attack requires only network reachability with no credentials. Review HFM audit and access logs around the Security component for unauthenticated requests or unexpected data creation, modification, or deletion.