CVE-2026-87208
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete on some data. Attacks can lead to confidentiality and integrity breaches.
Risk Assessment
The risk includes unauthorized access and modification of financial data, potentially leading to errors in reports and business decisions.
Recommendation
It is recommended to apply Oracle patches and implement access controls and data change monitoring.
Other vulnerabilities in Oracle Hyperion Financial Management
See all- CVE-2026-87230Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, with attacks potentially impacting additional products (scope change). It can result in unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 10.0.
- CVE-2026-87223Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data and causing a hang or frequently repeatable crash (complete DoS). CVSS 3.1 Base Score 9.1.
- CVE-2026-87217Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to compromise the system, enabling unauthorized creation, deletion, or modification of critical data as well as unauthorized access to it. CVSS 3.1 Base Score 9.1.
- CVE-2026-87214Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with HTTP network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87189Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows a high-privileged attacker with Oracle Net network access to take over the system, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-87188Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with HTTP network access to fully take over the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87186Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) affecting version 11.2.26.0.000. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running the system to take it over, with attacks potentially impacting additional products (scope change). CVSS 3.1 Base Score 9.6.
- CVE-2026-87184Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via SQL can easily exploit it, leading to takeover of the system. CVSS 3.1 Base Score 9.8.
- CVE-2026-87176Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
- CVE-2026-87175Critical
Vulnerability in Oracle Hyperion Financial Management (component: Security) version 11.2.26.0.000. An unauthenticated attacker with network access via TCP can easily exploit it, leading to unauthorized creation, deletion, or modification of data and unauthorized access to data. CVSS 3.1 Base Score 9.1.
Original NVD description (English source)
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS