CVE-2026-87207

A vulnerability in the Security component of Oracle Hyperion Financial Management, affecting version 11.2.26.0.000, allows a high-privileged attacker with network access to attack the product via SQL and completely take over the Hyperion Financial Management deployment. Because exploitation requires an already-privileged account and network reachability to the SQL-facing tier, the realistic attacker is a malicious or compromised insider, a rogue administrator, or an attacker who has already stolen high-privilege credentials. Successful attacks fully compromise confidentiality, integrity, and availability of the financial consolidation data and application (CVSS 3.1: 7.2, AV:N/AC:L/PR:H). Only on-premises installations of the affected 11.2.26.0.000 release are in scope, typically large-enterprise finance departments running Oracle's EPM stack. There is no known public proof of concept and no indication of in-the-wild exploitation; the flaw is not on CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Hyperion Financial Management 11.2.x, moving off 11.2.26.0.000 to the patched release per Oracle's CPU advisory. Restrict network access to the HFM application and database tiers (segmentation, allow-listing, no direct internet exposure), enforce least privilege and MFA for administrative and database accounts, and audit privileged-account activity and anomalous SQL statements against the HFM schemas for signs of abuse.