CVE-2026-87184

Analyzed Analyzed - Analysis Complete

Unauthenticated SQL Injection in Oracle Hyperion Financial Management

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87184

EUVD

EUVD-2026-79839

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	hyperion_financial_management	11.2.26.0.000

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-89	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Hyperion Financial Management version 11.2.26.0.000. It allows an unauthenticated attacker with network access to exploit it via SQL injection, potentially leading to full system compromise and takeover of the affected software.

Detection Guidance

This vulnerability affects Oracle Hyperion Financial Management version 11.2.26.0.000 and can be exploited via SQL injection. Detection requires checking for exposed instances of this version and verifying if SQL injection attempts are possible. No specific commands are provided in the context.

Impact Analysis

If you use the affected Oracle Hyperion Financial Management version, an attacker could gain complete control over the system. This could lead to unauthorized data access, modification, or deletion, disrupting financial operations and exposing sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches. Organizations may face legal penalties, reputational damage, and loss of customer trust if sensitive data is compromised.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Hyperion Financial Management version 11.2.26.0.000. Isolate the affected system from untrusted networks until patched. Monitor network traffic for unusual SQL queries targeting the component.

Hi! I’m here to help you understand CVE-2026-87184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70