CVE-2026-87172 Oracle CVE debrief

Who should care

Security teams, IT administrators, and financial management teams responsible for Oracle Hyperion Financial Management should assess exposure and apply necessary patches or mitigations.

Why it matters

A critical vulnerability in Oracle Hyperion Financial Management requires immediate attention to assess exposure and apply necessary patches or mitigations to prevent potential system takeover and data compromise.

• Potential system takeover by low-privileged attackers
• Compromise of confidentiality, integrity, and availability
• Scope change impacting additional products
• Verification of patch application and system security

Technical summary

The vulnerability in Oracle Hyperion Financial Management 11.2.26.0.000 allows low-privileged attackers with network access via HTTP to compromise the system, potentially leading to a takeover. The CVSS 3.1 Base Score is 9.9, indicating a critical vulnerability. The vulnerability impacts confidentiality, integrity, and availability, and security teams must assess exposure and apply necessary patches or mitigations to prevent potential system takeover and data compromise. The affected version is 11.2.26.0.000, and the vulnerability is exploitable via HTTP.

Defensive priority

Immediate attention is required to assess exposure and apply necessary patches or mitigations.

Recommended defensive actions

• Assess exposure of Oracle Hyperion Financial Management 11.2.26.0.000 in your environment.
• Apply necessary patches or mitigations as recommended by Oracle.
• Monitor network access and privileges to prevent exploitation.
• Review and update incident response plans to address potential impacts.
• Verify patch application and system security.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impact, and affected versions. The vulnerability has a CVSS 3.1 Base Score of 9.9, indicating a critical vulnerability. There are no known exploits, but defenders should verify patch application and system security. The affected version is 11.2.26.0.000, and the vulnerability is exploitable via HTTP.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.