CVE-2026-87227

CVE-2026-87227 is a vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. An authenticated, low-privileged attacker with network access via HTTP can exploit the flaw with low complexity and no user interaction to fully compromise the application. A successful attack results in complete takeover of Oracle Hyperion Financial Management, with high impact on the confidentiality, integrity, and availability of financial data (CVSS 3.1 base score 8.8). Organizations running on-premises HFM 11.2.26.0.000 with HTTP-reachable services and low-privileged user accounts (e.g., general finance users) are affected. No public proof-of-concept is known and the flaw is not on CISA's KEV list, so exploitation is not currently observed in the wild.

What to do: Apply the Oracle Critical Patch Update that remedies this flaw to Hyperion Financial Management 11.2.26.0.000 as soon as it is available, prioritizing any instance reachable over HTTP. Restrict network access to Hyperion services (workspace, HFM web tier) to trusted VPN/internal ranges and enforce strong role-based access so low-privileged accounts are minimized. Review audit logs for anomalous privilege changes, unexpected account creation, or data access by low-privilege users that could indicate attempted exploitation.