CVE-2026-87234

Oracle Hyperion Financial Management version 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged authenticated attacker with network access via HTTP to compromise the application. Successful exploitation gives the attacker unauthorized ability to create, delete, or modify critical data, as well as read access to all data accessible through Hyperion Financial Management. The vulnerability carries a CVSS 3.1 base score of 8.1 (high), driven by full confidentiality and integrity impact, though availability is not affected. Organizations running the affected 11.2.26.0.000 release — typically finance departments using Hyperion for consolidation and close processes — are at risk, especially if the application is reachable by broad sets of authenticated internal users. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept or observed exploitation is known.

What to do: Apply the Oracle Critical Patch Update that remediates this issue for Hyperion Financial Management 11.2.26.0.000 as soon as patching windows allow. Restrict HTTP access to the HFM environment to only necessary finance and administrative users, and enforce least-privilege roles since the attack requires only a low-privileged account. Review audit logs for unexpected data modifications or access by low-privilege accounts as a detection measure.