CVE-2026-87177 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Financial Management deployments, particularly those with version 11.2.26.0.000, should assess exposure and prioritize verification and remediation efforts.

Why it matters

Defenders should care about CVE-2026-87177 because it allows low-privileged attackers to compromise Oracle Hyperion Financial Management, potentially leading to unauthorized data access or modifications, and impacting additional products. Verification of exposure, especially for version 11.2.26.0.000, and remediation are crucial.

• Potential unauthorized access to critical data
• Possible update, insert, or delete access to some data
• Scope change impacting additional products
• Verification of exposure and remediation priority

Technical summary

The vulnerability in Oracle Hyperion Financial Management, component: Security, allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data, as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data.

Defensive priority

Defenders should prioritize verifying exposure of Oracle Hyperion Financial Management version 11.2.26.0.000, assessing network access controls, and monitoring for suspicious activity.

Recommended defensive actions

• Verify exposure of Oracle Hyperion Financial Management version 11.2.26.0.000
• Assess network access controls to restrict low-privileged attacker access
• Monitor for suspicious activity indicating potential exploitation
• Review and apply Oracle's security updates for affected versions
• Perform a thorough review of system logs for indicators of compromise
• Inventory all instances of Oracle Hyperion Financial Management to ensure comprehensive coverage
• Track and document remediation progress and verification efforts

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions. Oracle's security alert page may contain additional information. The vulnerability has a CVSS 3.1 Base Score of 8.5, indicating high severity. Defenders should verify exposure, especially for version 11.2.26.0.000, and prioritize remediation efforts. The NVD entry is currently Undergoing Analysis, and the CVE record was published on 2026-09-15T20:19:05.513Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.