CVE-2026-87178 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Hyperion Financial Management systems, particularly those with high-privileged users and network access via SQL, should assess exposure and apply remediation.

Why it matters

CVE-2026-87178 is a high-severity vulnerability in Oracle Hyperion Financial Management that allows a high-privileged attacker to compromise the system and access critical data. Defenders should assess exposure, apply remediation, and review access controls.

• Potential unauthorized creation, deletion, or modification of critical data
• Potential unauthorized access to critical or all accessible data
• Need for high-privileged user access control review
• Requirement for monitoring suspicious SQL activity

Technical summary

The vulnerability in Oracle Hyperion Financial Management allows a high-privileged attacker with network access via SQL to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical or all accessible data. The CVSS 3.1 Base Score is 8.7, indicating high severity. The vulnerability affects version 11.2.26.0.000 of Oracle Hyperion Financial Management. Defenders should assess exposure, apply remediation, and review access controls for high-privileged users. The vulnerability has a high impact on confidentiality and integrity.

Defensive priority

High priority for defenders to assess exposure and apply remediation

Recommended defensive actions

• Assess exposure of Oracle Hyperion Financial Management version 11.2.26.0.000
• Apply remediation as recommended by Oracle
• Review and update access controls for high-privileged users
• Monitor for suspicious SQL activity
• Perform vulnerability assessment and penetration testing
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert also provides relevant information. The vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000, and defenders should verify exposure and apply remediation. The CVSS 3.1 Base Score is 8.7, indicating high severity. Defenders should assess exposure, apply remediation, and review access controls. The vulnerability allows a high-privileged attacker with network access via SQL to The CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.