CVE-2026-87235

CVE-2026-87235 is a difficult-to-exploit, unauthenticated vulnerability in the Security component of Oracle Hyperion Financial Management version 11.2.26.0.000, reachable by a network attacker over SSH. A successful attack requires no privileges or user interaction (CVSS 3.1: 7.4, AV:N/AC:H/PR:N/UI:N) and allows the attacker to gain unauthorized creation, deletion, or modification access to critical data — up to all HFM-accessible data — as well as unauthorized read access to that data, with high confidentiality and integrity impact and no availability impact. The affected population is organizations running the supported on-premises release 11.2.26.0.000 of Hyperion Financial Management, typically large enterprise finance departments. No public proof-of-concept is known, the issue is not on the CISA Known Exploited Vulnerabilities list, and there are no reports of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87235 and move affected 11.2.26.0.000 systems to the patched release. Restrict SSH access on Hyperion Financial Management hosts to trusted administrative networks or a management bastion, since the attack vector is unauthenticated network access via SSH. Review HFM application and financial-consolidation data for unauthorized creation, modification, or deletion around the period the vulnerable version was in service.