What is the CVSS score of CVE-2026-87194?

CVE-2026-87194 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Which versions of Oracle are affected by CVE-2026-87194?

Oracle Hyperion Financial Management 11.2.26.0.000 - the platform many organizations rely on for consolidated financial reporting and close - can be accessed without authentication by anyone with…

How to fix or mitigate CVE-2026-87194?

Within 24 hours, confirm whether Hyperion Financial Management 11.2.26.0.000 is deployed and internet-exposed, and if so restrict network access to the HTTP listener immediately via firewall rules, VPN-only access, or a reverse proxy with allow-listing so only known corporate networks and authorized users can reach it; inventory all instances including non-production copies that may hold production data. Within 7 days, contact Oracle Support to obtain the current patch or mitigation guidance for this CVE, monitor Oracle's Critical Patch Update cycle and security advisories for a fix release, enable and centrally collect Hyperion Security and audit logging to detect anomalous data-retrieval activity, and review database- and application-level access grants to ensure least-privilege on sensitive financial tables. Within 30 days, apply the vendor patch as soon as it is released, validate the fix in a test environment before production rollout, complete an access review of Hyperion user roles and provisioning, and stand up continuous monitoring for unexpected unauthenticated or anonymous access attempts against the application.

Oracle CVE-2026-87194

EUVD-2026-79849 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-36rv-wv9c-jq53

Authentication Bypass Oracle

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:59 vuln.today

CVE Published

Sep 15, 2026 - 20:19 nvd

HIGH 7.5

DescriptionNVD

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-control bypass in its Security component that permits unauthenticated attackers with network access over HTTP to reach data they should not be able to see. Successful exploitation yields high confidentiality impact — unauthorized access to critical data or complete access to all Hyperion Financial Management data accessible to the application — while integrity and availability are unaffected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm whether Hyperion Financial Management 11.2.26.0.000 is deployed and internet-exposed, and if so restrict network access to the HTTP listener immediately via firewall rules, VPN-only access, or a reverse proxy with allow-listing so only known corporate networks and authorized users can reach it; inventory all instances including non-production copies that may hold production data. …

Threat intelligence, references, and detailed analysis are available after sign-in.