CVE-2026-87211

CVE-2026-87211 is a vulnerability in the Security component of Oracle Hyperion Financial Management, affecting only version 11.2.26.0.000. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N). Successful exploitation gives the attacker unauthorized access to critical data, up to complete access to all data reachable through Oracle Hyperion Financial Management; the impact is confidentiality-only, with no effect on integrity or availability. Affected parties are enterprises running the on-premises Hyperion Financial Management consolidation software, typically finance departments at large organizations. No public proof-of-concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Hyperion Financial Management 11.2.26.0.000 as soon as it is available. Until patched, restrict HTTP access to Hyperion Financial Management endpoints to trusted finance users via VPN or an authenticating reverse proxy, since the flaw requires no credentials. Review web-server and application logs for unusual unauthenticated HTTP requests to the Security component, which may indicate probing for this flaw.