CVE-2026-87248 Detail

Nvd.Nist • September 15, 2026

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( ) or https:// means you’ve safely connected to the .gov website. sensitive information only on official, secure websites.

The CVE has recently been published to the CVE List and is now included within the NVD dataset.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Management executes to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

References to Advisories, Solutions, and Tools

We hope your visit was informative.

We have provided a link to this site because it has information that may be of interest to our users. NIST does not necessarily endorse the views expressed or the facts presented on this site. Further, NIST does not endorse any commercial products that may be advertised or available on this site.

You will now be directed to:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Oracle Vulnerabilities Expose Critical Data Risks Recent vulnerabilities have been identified in Oracle products, specifically CVE-2026-83141, CVE-2026-87248, and CVE-2026-83482. CVE-2026-83141 affects Oracle Field Service, allowing low privileged attackers to compromise data with a CVSS score of 7.7. CVE-2026-87248 impacts Oracle Hyperion Financial Management, enabling high privileged attackers to take over the system, with a CVSS score of 6.7. CVE-2026-83482 targets Oracle Contracts, allowing high privileged attackers to gain full control, scoring 7.2. All vulnerabilities are easily exploitable via HTTP access. The affected versions include Oracle E-Business Suite and Oracle Hyperion. These vulnerabilities pose significant risks to organizations using these products, as successful exploitation can lead to unauthorized access to critical data. The vulnerabilities were published on September 15, 2026, and are now included in the NVD dataset. 5 sources 52

Extracted Entities

CVE-2026-87248 Detail

The full story

Extracted Entities

Countries (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)