CVE-2026-87232

A vulnerability in the Security component of Oracle Hyperion Financial Management (HFM) version 11.2.26.0.000 allows an unauthenticated attacker to compromise the application, provided the attacker has access to the physical communication segment (adjacent/local network) attached to the server where HFM executes. Exploitation requires no privileges, no user interaction, and is rated as easy (CVSS 3.1 base score 8.1, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). A successful attack lets the attacker gain unauthorized read access to all HFM-accessible data and unauthorized ability to create, delete, or modify critical data, with no direct impact on availability. Organizations running the affected on-premises release are at risk primarily from malicious insiders or external attackers who have already gained a foothold on the same network segment as the HFM server. No public proof of concept is known, the CVE is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-87232 and move off HFM 11.2.26.0.000 to a patched release. Because the attack path is unauthenticated but adjacent-network only, segment HFM servers onto a tightly restricted VLAN and permit only known application, database, and administrative hosts to reach them. Audit HFM security configuration (users, roles, permissions) and financial application data for unauthorized changes or access.