CVE-2026-87209

A high-severity (CVSS 3.1: 7.1) flaw in the Security component of Oracle Hyperion Financial Management allows a low-privileged attacker with network access via HTTP to compromise the application. Exploitation is described by Oracle as easy and requires no user interaction, only a valid low-privilege account. A successful attack yields unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data, as well as the ability to cause a partial denial of service (integrity is not impacted). Only version 11.2.26.0.000 is listed as affected. There is no known public proof of concept, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this issue and move to a release later than 11.2.26.0.000 as directed by Oracle's advisory. Restrict HTTP access to Hyperion Financial Management to trusted internal networks or VPN, and enforce least-privilege on user accounts since exploitation requires only a low-privileged login. Review audit logs for unusual data access or availability degradation by low-privilege accounts to rule out prior compromise.