CVE-2026-87241

Oracle Hyperion Financial Management 11.2.26.0.000 contains a vulnerability in its Security component that can be exploited by an unauthenticated attacker who can reach the network segment attached to the server running the product. The attack requires no privileges, no user interaction, and low complexity, meaning any device on the same LAN, VLAN, or VPN-connected segment as the HFM server is a potential launch point. A successful attack allows full compromise of data confidentiality and integrity — including unauthorized creation, deletion, or modification of critical financial data, plus unauthorized read access to all HFM-accessible data — though availability is not impacted. The affected population is limited to organizations running the on-premises 11.2.26.0.000 release of this enterprise financial close and consolidation product. There is no evidence of exploitation in the wild and no public proof of concept, but the low attack complexity and high data impact make patching a priority for exposed deployments.

What to do: Apply the Oracle Critical Patch Update that remediates this issue as soon as it is available for your 11.2.x deployment. Until patched, restrict network access to the HFM application tier with firewall rules and VLAN segmentation so only known finance/IT clients and admin workstations can reach the service ports, and treat VPN or jump-host access into that segment as part of the attack surface. Review HFM audit logs for unexpected data creation, modification, or deletion by unauthenticated or anomalous sources.