What is the CVSS score of CVE-2026-87243?

CVE-2026-87243 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.

Which versions of Oracle are affected by CVE-2026-87243?

Oracle Hyperion Financial Management 11.2.26.0.000 carries an unpatched Security component flaw that allows an unauthenticated attacker on an adjacent network segment to read and alter the financial…

How to fix or mitigate CVE-2026-87243?

Within 24 hours, confirm which Hyperion Financial Management 11.2.26.0.000 instances are deployed, isolate them from untrusted or shared network segments, and verify that only known, trusted hosts can reach the Security component interfaces; enable and review authentication, configuration-change, and data-access logging on those systems and open a case with Oracle to request patch timing. Within 7 days, enforce strict network segmentation and host-based firewall rules around the Hyperion environment, restrict adjacent-segment access to the minimum necessary service accounts and addresses, verify integrity of recent consolidation data against independent records, and validate that connected EPM components are equally restricted. Within 30 days, apply the vendor-released patch as soon as Oracle publishes a fixed version for Hyperion Financial Management 11.2.26.0.000, re-test after deployment, and in the interim maintain compensating segmentation and monitoring while reviewing audit trails for signs of unauthorized read or modification of consolidation data.

Oracle CVE-2026-87243

EUVD-2026-79898 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-w85v-pcxw-ff38

Authentication Bypass Oracle

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:53 vuln.today

CVE Published

Sep 15, 2026 - 20:19 nvd

HIGH 8.0

DescriptionNVD

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. While the vulnerability is in Oracle Hyperion Financial Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm which Hyperion Financial Management 11.2.26.0.000 instances are deployed, isolate them from untrusted or shared network segments, and verify that only known, trusted hosts can reach the Security component interfaces; enable and review authentication, configuration-change, and data-access logging on those systems and open a case with Oracle to request patch timing. …

Threat intelligence, references, and detailed analysis are available after sign-in.