# CVE-2026-87172: Oracle Hyperion Financial Management authentication bypass in Security component

Source: https://junglewise.ai/threats/cve-2026-87172-oracle-hyperion-financial-management-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87172 · Severity: critical · CVSS 9.9 · Published 2026-09-15

Oracle Hyperion Financial Management is a critical enterprise financial planning and consolidation system used by large organizations to manage budgets and close financial records. A vulnerability in its security component allows a low-privileged attacker with network access to bypass authentication controls and take over the application, potentially exposing or modifying sensitive financial data and affecting multiple connected systems.

Technologies: [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-87172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87172 being exploited in the wild.

**How severe is CVE-2026-87172?** Critical severity, with a CVSS score of 9.9, published 15 September 2026.

**Which products and versions are affected?** Oracle Hyperion Financial Management 11.2.26.0.000.

**Is there a fix for CVE-2026-87172?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87172 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87172?** Check whether you run Oracle Hyperion Financial Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an easily exploitable authentication or authorization flaw in the Security component of Oracle Hyperion Financial Management version 11.2.26.0.000. It requires low privilege credentials and network access via HTTP to trigger, but does not require user interaction. Successful exploitation grants an attacker complete control over the application with high impacts to confidentiality, integrity, and availability. The vulnerability has scope change implications, meaning compromising Hyperion can affect other connected Oracle products and systems. Patch availability and detailed technical mitigation guidance are expected from Oracle's official security advisory.

## Affected products

- Oracle Hyperion Financial Management 11.2.26.0.000

## Timeline

- 2026-09-15: disclosed
- 2026-09: advisory: Oracle Critical Patch Update September 2026

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Hyperion Financial Management privilege escalation in Security component](https://junglewise.ai/threats/cve-2026-87250-oracle-hyperion-financial-management-privilege-escalation-in)
- [Oracle Hyperion Financial Management CSRF vulnerability](https://junglewise.ai/threats/cve-2026-87249-oracle-hyperion-financial-management-csrf-vulnerability)
- [Oracle Hyperion Financial Management privilege escalation in Security component](https://junglewise.ai/threats/cve-2026-87248-oracle-hyperion-financial-management-privilege-escalation-in)
- [Oracle Hyperion Financial Management security component vulnerability](https://junglewise.ai/threats/cve-2026-87247-oracle-hyperion-financial-management-security-component)
- [Oracle Hyperion Financial Management authentication bypass in Security component](https://junglewise.ai/threats/cve-2026-87246-oracle-hyperion-financial-management-authentication-bypass-in)