CVE-2026-87226

Oracle Hyperion Financial Management 11.2.26.0.000 contains a vulnerability in its Security component that allows a low-privileged attacker with network access via HTTP to fully compromise the application. Oracle rates it CVSS 3.1 8.8 (high), with high impact to confidentiality, integrity, and availability — effectively a complete takeover of the Financial Management deployment. The flaw is described as easily exploitable but requires an authenticated, low-privileged account, so attackers must first hold valid credentials. Any organization running the affected 11.2.26.0.000 release is at risk, especially where the HFM web tier is reachable by broad internal or external user populations. No public proof-of-concept exists and the CVE is not on CISA's KEV list, so exploitation is none known at this time.

What to do: Apply Oracle's latest Critical Patch Update for Hyperion 11.2.x, which remediates CVE-2026-87226, prioritizing any host running 11.2.26.0.000. Until patched, restrict HTTP access to the HFM web tier to trusted networks and enforce least-privilege on user accounts. Review audit logs for anomalous activity by low-privileged users, such as unexpected privilege changes or access to sensitive financial data.