CVE-2026-87177
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized access to data and unauthorized update, insert, or delete of data, and may impact additional products (scope change).
Risk Assessment
Risk includes compromise of confidentiality and integrity of data, including critical data, and potential impact on other systems.
Recommendation
Apply Oracle patches for version 11.2.26.0.000 and restrict HTTP access to the system to trusted users.
Other vulnerabilities in Oracle Hyperion Financial Management
See all- CVE-2026-87230Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, with attacks potentially impacting additional products (scope change). It can result in unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 10.0.
- CVE-2026-87223Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data and causing a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 9.1.
- CVE-2026-87217Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 9.1.
- CVE-2026-87214Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with HTTP network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87189Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with Oracle Net network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87188Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to fully take over the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87186Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the system to take it over, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.6.
- CVE-2026-87184Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via SQL can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87176Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
- CVE-2026-87175Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
Original NVD description (English source)
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS