CVE-2026-87231

CVE-2026-87231 is a vulnerability in the Security component of Oracle Hyperion Financial Management affecting version 11.2.26.0.000. It allows an unauthenticated attacker with network access via HTTP to compromise the application, though the CVSS vector (AC:H) indicates it is difficult to exploit, likely requiring specialized conditions or race-like behavior. A successful attack can result in a complete takeover of Oracle Hyperion Financial Management with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). The product is enterprise financial consolidation software deployed almost exclusively inside corporate data centers, so the attacker population is limited to those who can reach the HFM web tier over the network. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no evidence of active exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw for Hyperion Financial Management 11.2, moving off the affected 11.2.26.0.000 build as identified in Oracle's advisory. Restrict HTTP access to the HFM web tier to trusted internal networks or VPN, and place it behind an authenticated reverse proxy if remote access is required. Review web server and application logs for anomalous unauthenticated requests from unexpected sources.