## Summary
CVE-2026-87225 is a vulnerability in Oracle Hyperion Financial Management (Oracle Hyperion), component Security, affecting the supported version 11.2.26.0.000. It is described as easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to unauthorized access to critical data and partial denial of service.
## Technical Details
- Attack vector: NETWORK via HTTP
- Privileges required: PR:L (low privileges)
- User interaction: UI:N (none)
- Impact scope: S:U (unchanged)
- Confidentiality impact: C:H
- Availability impact: A:L
- Integrity impact: I:N
## Affected
- Oracle Hyperion Financial Management version 11.2.26.0.000
## Impact
- Unauthorized access to critical data
- Complete access to all Oracle Hyperion Financial Management accessible data
- Partial denial of service (partial DoS) of Oracle Hyperion Financial Management
## Mitigation
1. Apply the vendor’s security fix/patch for Oracle Hyperion Financial Management affecting 11.2.26.0.000 (exact fixed version not provided in the available data).
2. Restrict network access to the Hyperion HTTP endpoints to trusted sources only (e.g., allowlisting).
3. Review and harden exposure of the Security component interfaces to reduce the likelihood of low-privileged remote exploitation.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L