## Summary
CVE-2026-87208 is a vulnerability in Oracle Hyperion Financial Management (Oracle Hyperion), component Security, affecting the supported version 11.2.26.0.000. It is described as easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to unauthorized access to critical data and unauthorized update/insert/delete actions.
## Technical Details
- Affected component: Security (Oracle Hyperion Financial Management)
- Attack vector: NETWORK via HTTP
- Attacker prerequisites (per NVD):
- Network access over HTTP
- Low privileges (PR:L)
- No user interaction required (UI:N)
- Impact scope (per NVD):
- Confidentiality impact: C:H
- Integrity impact: I:L
- Availability impact: A:N
- CVSS 3.1: 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
## Affected
- Oracle Hyperion Financial Management version 11.2.26.0.000
## Impact
- Unauthorized access to critical data
- Complete access to all Oracle Hyperion Financial Management accessible data (as stated in NVD)
- Unauthorized update, insert, or delete access to some accessible data
## Mitigation
1. Restrict network access to Oracle Hyperion Financial Management over HTTP (limit exposure to trusted networks/hosts).
2. Apply the vendor’s security fix/patch for 11.2.26.0.000 once available (no patch details were provided in the supplied material).
3. Monitor for suspicious access patterns consistent with low-privileged network activity over HTTP (specific detection indicators were not provided).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N