## Summary
CVE-2026-87229 is an unauthenticated, network-accessible vulnerability in Oracle Hyperion Financial Management (Oracle Hyperion), affecting 11.2.26.0.000. An attacker can access the affected service via HTTP and compromise the application.
## Technical Details
- Attack vector: NETWORK via HTTP
- Privileges required: PR:N (no authentication)
- User interaction: UI:N (none)
- Complexity: AC:L (easily exploitable)
- Resulting behavior: successful exploitation can lead to unauthorized access and changes to Hyperion data, including unauthorized read access to a subset of accessible data.
## Affected
- Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security)
## Impact
- Confidentiality impact: C:L (limited unauthorized read access to a subset of accessible data)
- Integrity impact: I:H (unauthorized creation, deletion, or modification of critical data)
- Availability impact: A:N
## Mitigation
1. Patch immediately to a vendor-fixed version of Oracle Hyperion Financial Management for the affected 11.2.26.0.000 release (exact fixed version not provided in the available data).
2. Restrict network exposure of the Hyperion HTTP endpoint(s) to trusted networks only (since exploitation is AV:N and PR:N).
3. Monitor for anomalous unauthenticated requests to the Hyperion Security-related surfaces and investigate unexpected data creation/deletion/modification events.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N