CVE-2026-87228

A high-severity (CVSS 8.2) vulnerability in the Security component of Oracle Hyperion Financial Management allows an unauthenticated remote attacker with network access via HTTP to compromise the application. The flaw affects supported version 11.2.26.0.000 and is rated easily exploitable, requiring no privileges, credentials, or user interaction. Successful exploitation can result in unauthorized read access to critical data — up to complete access to all data reachable by Hyperion Financial Management — as well as unauthorized insert, update, or delete access to some of that data; availability is not impacted. Organizations running the affected on-premises release are exposed wherever the service is network-reachable, with the highest risk to any internet-facing deployments. No public proof of concept is known, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87228 to Hyperion Financial Management 11.2.26.0.000 as soon as it is available for your release. Until patched, restrict HTTP access to Hyperion Financial Management servers to trusted internal networks or VPN and monitor for unauthenticated requests targeting the Security component. Review HFM application data and audit logs for signs of unexpected reads or unauthorized inserts, updates, or deletes.