CVE-2026-87238

CVE-2026-87238 is a high-severity (CVSS 8.8) vulnerability in the Security component of Oracle Hyperion Financial Management, affecting supported version 11.2.26.0.000. A remote, authenticated attacker holding only low-privileged credentials can exploit the flaw through SQL — consistent with a SQL injection-style attack against the application — with no user interaction required. Successful exploitation can fully compromise Oracle Hyperion Financial Management, with high impact on the confidentiality, integrity, and availability of the system, effectively a complete takeover of the affected deployment. The exposure is limited to organizations running the on-premises Hyperion Financial Management 11.2.26 release, an enterprise financial consolidation product typically deployed inside corporate networks, so exploitation would most likely come from an insider, a compromised low-privilege account, or an attacker with lateral network access. There is no known public proof of concept and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87238 and upgrade Hyperion Financial Management off version 11.2.26.0.000 to the patched release. Restrict network and SQL-level access to Hyperion services and databases to trusted sources, enforce least-privilege on application and user database accounts, and audit for suspicious privilege escalation, unexpected account creation, or anomalous SQL activity from low-privilege users.