CVE-2026-87224

CVE-2026-87224 is a high-severity (CVSS 3.1: 8.8) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting only version 11.2.26.0.000. It is easily exploitable by a low-privileged (authenticated) attacker who has network access to the product over HTTP, and successful exploitation results in a complete takeover of Oracle Hyperion Financial Management with high impact on confidentiality, integrity, and availability. In practice, this means any user with even minimal valid credentials — such as a basic finance user or service account — could potentially escalate to full control of the application and its financial data. The flaw is delivered through Oracle's Critical Patch Update process and requires no user interaction or special conditions. There is no known public proof-of-concept, it is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-87224 to all Oracle Hyperion Financial Management 11.2.26.0.000 installations as soon as possible. In the interim, restrict HTTP access to the HFM web tier to trusted internal networks or VPN, and review low-privilege accounts for anomalous activity. Verify patch status across all EPM environments, including test and disaster-recovery instances that are often forgotten but reachable.