CVE-2026-87237

CVE-2026-87237 is a difficult-to-exploit vulnerability in the Security component of Oracle Hyperion Financial Management (HFM), affecting only version 11.2.26.0.000. A low-privileged, authenticated attacker with network access via HTTP can exploit it to fully compromise the HFM installation, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Exploitation requires valid low-level credentials and a high-complexity attack path, but success means complete takeover of the application. Only organizations running release 11.2.26.0.000 of Oracle Hyperion Financial Management are affected. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no evidence of active exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87237 to any Hyperion Financial Management instance running 11.2.26.0.000 — do not delay simply because the flaw is rated difficult to exploit, since successful attacks result in full takeover. Restrict HTTP access to HFM to trusted internal networks or VPN, and audit low-privileged accounts with HTTP access for suspicious activity.