# CVE-2026-87186: Oracle Hyperion Financial Management security vulnerability

Source: https://junglewise.ai/threats/cve-2026-87186-oracle-hyperion-financial-management-security-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87186 · Severity: critical · CVSS 9.6 · Published 2026-09-15

Oracle Hyperion Financial Management is a financial planning and consolidation system used by enterprises to manage budgets, forecasts, and reporting. A critical vulnerability in its security component allows an attacker with physical access to the network segment to completely compromise the system without authentication, potentially gaining unauthorized access to sensitive financial data and disrupting operations. The impact extends beyond the affected application to potentially compromise other systems within the environment.

Technologies: [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-87186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87186 being exploited in the wild.

**How severe is CVE-2026-87186?** Critical severity, with a CVSS score of 9.6, published 15 September 2026.

**Which products and versions are affected?** Oracle Hyperion Financial Management 11.2.26.0.000.

**Is there a fix for CVE-2026-87186?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87186 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-87186?** Check whether you run Oracle Hyperion Financial Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the security component of Oracle Hyperion Financial Management version 11.2.26.0.000 and is easily exploitable without requiring authentication or user interaction. The attack vector is adjacent network access, requiring the attacker to be on the same physical communication segment (e.g., local network) as the hardware running the application. A successful exploit results in complete compromise of Oracle Hyperion Financial Management with high impact to confidentiality, integrity, and availability. The vulnerability also has a scope change impact, meaning attacks on this component can significantly affect other products in the environment. Patch availability should be verified through Oracle's security advisories.

## Affected products

- Oracle Hyperion Financial Management 11.2.26.0.000

## Timeline

- 2026-09-15: disclosed

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Hyperion Financial Management privilege escalation in Security component](https://junglewise.ai/threats/cve-2026-87250-oracle-hyperion-financial-management-privilege-escalation-in)
- [Oracle Hyperion Financial Management CSRF vulnerability](https://junglewise.ai/threats/cve-2026-87249-oracle-hyperion-financial-management-csrf-vulnerability)
- [Oracle Hyperion Financial Management privilege escalation in Security component](https://junglewise.ai/threats/cve-2026-87248-oracle-hyperion-financial-management-privilege-escalation-in)
- [Oracle Hyperion Financial Management security component vulnerability](https://junglewise.ai/threats/cve-2026-87247-oracle-hyperion-financial-management-security-component)
- [Oracle Hyperion Financial Management authentication bypass in Security component](https://junglewise.ai/threats/cve-2026-87246-oracle-hyperion-financial-management-authentication-bypass-in)