CVE-2026-87225

CVE-2026-87225 is a vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting supported version 11.2.26.0.000. A low-privileged attacker with network access to the product's HTTP interface can exploit the flaw easily, without user interaction, to gain unauthorized access to critical data — potentially complete access to all data accessible through HFM — and to cause a partial denial of service. Integrity is not impacted per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base score 7.1). Organizations running on-premises HFM 11.2.26.0.000, particularly finance and consolidation deployments holding sensitive financial close data, are affected. The flaw is not listed in CISA's KEV catalog and no public proof-of-concept is known, so exploitation status is currently none known.

What to do: Verify your HFM version immediately and prioritize any Oracle Critical Patch Update that addresses this flaw on 11.2.26.0.000 when released. Restrict HTTP access to HFM services to trusted finance users and admin networks via segmentation and allow-listing, since exploitation requires a low-privileged authenticated session. Review audit logs for unusual data access or export activity by low-privilege accounts and monitor service availability for signs of partial DoS.