CVE-2026-87236

A high-severity flaw (CVSS 7.1) in the Security component of Oracle Hyperion Financial Management allows a low-privileged authenticated attacker with HTTP network access to the product to access data they should not be entitled to see. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data, and can enable a partial denial of service against the application. The vulnerability affects the supported version 11.2.26.0.000 and is described by Oracle as easily exploitable, requiring only a low-privileged account and no user interaction. Impacts are limited to confidentiality and availability; integrity is not affected. No public proof of concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not currently known to be occurring.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to move off affected version 11.2.26.0.000. Restrict HTTP access to Hyperion Financial Management endpoints to trusted networks, VPN users, or an authenticated reverse proxy, and enforce least-privilege role assignments. Audit access logs for low-privileged accounts exhibiting unusual data-access patterns or activity consistent with denial-of-service attempts.