Description
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover via Low-Privilege HTTP Access
Action: Immediate Patch
AI Analysis

Impact

Oracle Hyperion Financial Management version 11.2.26.0.000 contains a security component flaw that is easily exploitable. A low-privileged attacker who can reach the application over HTTP can compromise the system, resulting in full takeover. The vulnerability would compromise confidentiality, integrity, and availability of the application data and services.

Affected Systems

Vendors affected are Oracle Corporation, product Oracle Hyperion Financial Management, specifically version 11.2.26.0.000. No other versions or components are listed as impacted.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 indicates a high severity impact across all CIA properties. The EPSS score is less than 1%, indicating a low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based via HTTP, with low privilege required. If exploited, the attacker can achieve a full takeover of the Hyperion instance.

Generated by OpenCVE AI on September 20, 2026 at 05:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch that updates Hyperion Financial Management to a non-affected version (check Oracle’s security alert for the latest release).
  • Restrict network reachability to the Hyperion HTTP interface by configuring firewalls or segmentation so only trusted IP ranges can connect.
  • Continuously monitor application logs for anomalous authentication attempts and verify that security components are configured to enforce strict access controls.

Generated by OpenCVE AI on September 20, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Takeover of Oracle Hyperion Financial Management

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title Hyperion Financial Management Security Component Vulnerability Enabling Remote Takeover
Weaknesses CWE-287

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Hyperion Financial Management Security Component Vulnerability Enabling Remote Takeover
Weaknesses CWE-287

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle hyperion Financial Management
CPEs cpe:2.3:a:oracle:hyperion_financial_management:11.2.26.0.000:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle hyperion Financial Management
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Hyperion Financial Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:18.147Z

Reserved: 2026-09-08T21:49:12.404Z

Link: CVE-2026-87226

cve-icon Vulnrichment

Updated: 2026-09-17T12:56:28.047Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:10.950

Modified: 2026-09-21T12:43:28.920

Link: CVE-2026-87226

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T05:45:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management