CVE-2026-87197 is a high severity missing authentication flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000. An unauthenticated attacker with HTTP network access can reach critical data and change some of it. Oracle addresses it in its September 2026 Critical Patch Update, so apply that patch.
What's affected
Affected: Oracle Hyperion Financial Management, supported version 11.2.26.0.000, component Security, reachable over HTTP. Oracle's risk matrix marks it as exploitable without authentication.
Oracle's description, repeated in the record, says a successful attack can give unauthorized access to critical data or complete access to all Hyperion Financial Management accessible data, plus unauthorized update, insert or delete access to some of that data. The score is CVSS 3.1 8.2 (High), vector AV:N/AC:L/PR:N/UI:N/C:H/I:L/A:N. The record and Oracle's page agree on the number.
The same Oracle risk matrix lists several other Hyperion Financial Management entries with similar scores, so you will probably be patching more than one CVE with the same update. I found no statement of exploitation for this CVE in the Oracle page, and the record does not list it in CISA KEV.
How to check if you're exposed
Hyperion Financial Management is an on-premises finance application, so the check is a patch inventory exercise.
Ask your Hyperion administrators for the installed release and patch level of Financial Management, and confirm whether it is 11.2.26.0.000 as in Oracle's advisory. Then compare the patch level with the September 2026 Critical Patch Update and its patch availability document, which Oracle publishes alongside the advisory and which lists the patch numbers for each product.
Also establish who can reach the Financial Management HTTP services. Since the attack needs no login and uses HTTP, an instance reachable from a wide internal network, a partner network or the internet is more exposed than one limited to a small set of finance users.
What to do now
- Confirm the installed Hyperion Financial Management release and patch level.
- Read the Oracle September 2026 Critical Patch Update advisory and its patch availability document for the correct patch numbers.
- Schedule the patch for a finance calendar quiet period, but do not wait for a quarter end if the instance is widely reachable.
- Restrict network access to the Financial Management HTTP endpoints to the users and systems that need them.
- Review web access logs from before the patch for unexpected requests to the Security component.
Why it matters
The record classes this as missing authentication for a critical function (CWE-306). A part of the Security component can be used without proving who you are. For an application that holds consolidated financial results, intercompany data and reporting, that is the sort of weakness that auditors care about as much as security teams do.
The score of 8.2 comes from high confidentiality impact, with low integrity impact and none on availability. In plain terms: reading is the main risk, and limited tampering is possible too. Tampering with financial data is rare in the wild but expensive when it happens, because the numbers feed reporting that others rely on.
Oracle ships fixes quarterly, and its own advisory notes that attackers keep trying vulnerabilities for which patches already exist. Organisations that fall behind on the quarterly update are the ones exposed. Make the CPU a standing calendar item.
Quick check
Does the attacker need credentials?
No. Oracle and the record both describe an unauthenticated attacker with network access over HTTP.
Where is the fix?
In Oracle's September 2026 Critical Patch Update. Use the patch availability document for the exact patch for your platform.
Sources
Last reviewed: 18 October 2026.
