CVE-2026-87244 Oracle Corporation CVE debrief

Who should care

Administrators and security teams responsible for Oracle Hyperion Financial Management deployments should assess exposure and prioritize security measures. They should also monitor for potential security incidents, verify network access controls and HTTP security, and apply vendor patches or updates as available. Additionally, they should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-87244 is a high-severity vulnerability in Oracle Hyperion Financial Management that allows high privileged attackers to compromise the system. Defenders should assess exposure, prioritize security measures, and monitor for potential security incidents.

• Potential system compromise and data breaches
• Required security review and patching
• Monitoring for potential security incidents
• Verification of network access controls and HTTP security

Technical summary

A vulnerability in Oracle Hyperion Financial Management allows high privileged attackers with network access via HTTP to compromise the system, potentially leading to takeover. The vulnerability has a CVSS 3.1 Base Score of 7.2, indicating high confidentiality, integrity, and availability impacts. The affected version is 11.2.26.0.000. The vulnerability is classified as easily exploitable, requiring immediate security review and patching. Defenders should assess exposure, prioritize security measures, and monitor for potential security incidents.

Defensive priority

High privileged attackers with network access via HTTP can compromise Oracle Hyperion Financial Management, requiring immediate security review.

Recommended defensive actions

• Review and assess exposure of Oracle Hyperion Financial Management version 11.2.26.0.000
• Verify network access controls and HTTP security measures
• Monitor system logs for potential security incidents
• Apply vendor patches or updates as available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Oracle Hyperion Financial Management. The vendor advisory from Oracle also provides additional context. The vulnerability has a CVSS 3.1 Base Score of 7.2, with high impacts on confidentiality, integrity, and availability. The supported version that is affected is 11.2.26.0.000. The CVE record was published on 2026-09-15T20:19:13.153Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.