CVE-2026-87230 & 36 Critical Oracle CVEs (CVSS 10): Hyperion Financial Management Detection and Remediation Guide

The National Vulnerability Database has published 37 CRITICAL-severity CVEs affecting Oracle products in the last 72 hours, all carrying a network attack vector and CVSS scores up to the maximum 10.0. The most severe — CVE-2026-87230 (CVSS 10.0) — affects Oracle Hyperion Financial Management (HFM), the enterprise performance management platform that finance teams use to consolidate and report financial results. A maximum-severity, remotely exploitable flaw in a system that holds your organization's most sensitive financial data is a board-level risk, not just a patching ticket.

In my experience leading IR engagements, enterprise performance management (EPM) and ERP-adjacent platforms are chronically under-monitored. They sit deep inside the network, run with broad service-account privileges, integrate with databases and directory services, and are often excluded from EDR coverage because of vendor support concerns. That combination — high-value data, weak telemetry, and now a wave of critical network-exploitable CVEs — makes this disclosure cycle one that defenders need to treat with urgency.

This post breaks down what's affected, how to prioritize, and — most importantly — how to detect exploitation attempts against Hyperion and adjacent Oracle components while you work through the patching cycle.

What Was Disclosed

NVD published the following 37 critical CVEs in this window:

• CVE-2026-87230 (CVSS 10.0) — Oracle Hyperion Financial Management
• CVE-2026-71163, CVE-2026-73945, CVE-2026-73946, CVE-2026-73948, CVE-2026-73957, CVE-2026-73962
• CVE-2026-82997, CVE-2026-82998, CVE-2026-82999, CVE-2026-83001, CVE-2026-83006, CVE-2026-83029, CVE-2026-83031, CVE-2026-83038, CVE-2026-83039, CVE-2026-83040, CVE-2026-83043, CVE-2026-83055, CVE-2026-83056, CVE-2026-83057, CVE-2026-83058, CVE-2026-83064, CVE-2026-83103, CVE-2026-83105, CVE-2026-83107, CVE-2026-83149, CVE-2026-83196, CVE-2026-83197, CVE-2026-83229, CVE-2026-83260, CVE-2026-83268, CVE-2026-83282
• CVE-2026-87172, CVE-2026-87189, CVE-2026-87214, CVE-2026-87223

The clustering of these identifiers (contiguous blocks in the 830xx, 831xx, and 832xx ranges) indicates a coordinated disclosure consistent with an Oracle Critical Patch Update (CPU) cycle, with NVD enrichment following. Defenders should treat this as a single remediation event across the Oracle estate rather than 37 isolated tickets.

Technical Analysis

The Headline Vulnerability: CVE-2026-87230 (CVSS 10.0)

CVE-2026-87230 is a vulnerability in Oracle Hyperion Financial Management, reachable over the network without authentication and without user interaction — the combination that produces a CVSS 10.0 score. A 10.0 network-vector score implies the following defender-relevant characteristics:

• Attack Vector: Network — the vulnerable component is exposed over HTTP/HTTPS (HFM is deployed on Oracle WebLogic Server and accessed via web application interfaces, typically on ports 7001, 7002, 19000, and the HFM-specific application ports).
• Attack Complexity: Low — no special conditions are required; exploitation is reliable.
• Privileges Required: None — no valid credentials needed.
• User Interaction: None — purely server-side exploitation.
• Scope: Changed — successful exploitation can impact resources beyond the vulnerable component's security authority (in practice: the underlying WebLogic domain, the host OS, and the backend Oracle Database holding financial data).
• Impact: High across Confidentiality, Integrity, and Availability — full compromise of the affected component.

Attack Surface and Exploitation Mechanics (Defender's View)

Hyperion Financial Management's web tier is served through WebLogic application server components. Historically, critical Oracle application-server flaws in this class are exploited through:

1. Direct HTTP requests to vulnerable application endpoints — unauthenticated requests to HFM web services or servlet paths, often involving crafted serialized payloads or path manipulation.
2. Post-exploitation command execution on the host — the WebLogic/HFM service process (running as a dedicated service account, frequently with local administrator or SYSTEM-level privileges on Windows, or as the oracle user on Linux) spawning child processes such as cmd.exe, powershell.exe, /bin/sh, or script interpreters. This is your highest-fidelity detection signal.
3. Outbound connections from the application server — reverse shells, C2 callbacks, or tooling downloads initiated by a server process that should normally only talk to its database, load balancer, and upstream clients.

Exploitation Status

At the time of writing, these CVEs are newly published to NVD. No public proof-of-concept code has been confirmed, and none of the 37 CVEs has yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog — but that is a lagging indicator, not a comfort signal. Historical precedent with critical Oracle application-server CVEs is unambiguous: weaponized exploitation typically follows within days to weeks of patch availability, because adversaries diff the patches to reconstruct the vulnerability. CVSS 10.0, no-authentication, network-reachable vulnerabilities in internet-adjacent middleware are among the fastest to be weaponized. Treat exploitation as imminent, not theoretical.

Affected Estate Beyond HFM

The remaining 36 CVEs span the broader Oracle product portfolio typical of a CPU release (database, middleware, EPM, and enterprise applications families). Because NVD enrichment is still populating, your first action is to pull Oracle's official Critical Patch Update advisory and map every CVE to your actual inventory. Do not scope your response to Hyperion alone if you run other Oracle middleware.

Detection & Response

The detections below target the post-exploitation behavior of a compromised WebLogic/HFM application server — the web service process spawning shells, downloaders, or reconnaissance tooling — and network-layer exploitation indicators. These are durable detections: even without knowing the exact exploit payload, they fire on what an attacker must do after successful exploitation.

Key processes to baseline on your Hyperion hosts: java.exe (WebLogic NodeManager and managed servers), and on Linux, Java processes under the WebLogic/HFM installation directories (e.g., /u01/oracle/, /opt/oracle/). Any shell, script interpreter, or LOLBin spawned by these Java processes is almost never legitimate.

Sigma Rules

---
title: Oracle WebLogic or Hyperion Java Process Spawning Shell
id: 3f8a1c42-9b7d-4e5a-a2c1-6d4e8f0a1b2c
status: experimental
description: Detects a WebLogic/Hyperion Financial Management Java process spawning command shells or script interpreters, a strong indicator of post-exploitation following compromise of an Oracle application server vulnerability such as CVE-2026-87230.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87230
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
      - '\curl.exe'
  filter_wls_admin:
    CommandLine|contains:
      - 'weblogic.security'
      - 'startManagedWebLogic'
  condition: selection_parent and selection_child and not filter_wls_admin
falsepositives:
  - Rare WebLogic administrative scripting invoked from JVM; investigate any hit on Hyperion hosts as high priority
level: critical
---
title: Linux Oracle Application Server Java Process Spawning Shell
id: 7c2e5b91-4a8f-4d3c-b6e9-1f5a7d9c2e4b
status: experimental
description: Detects a Java process associated with Oracle WebLogic or Hyperion installations spawning system shells or download utilities on Linux application servers, consistent with exploitation of network-reachable Oracle CVEs including CVE-2026-87230.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87230
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
  selection_parent_path:
    ParentCommandLine|contains:
      - 'weblogic'
      - 'hyperion'
      - 'fmwhome'
      - '/u01/oracle'
      - '/opt/oracle'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_parent_path and selection_child
falsepositives:
  - Oracle Enterprise Manager agent scripts; validate path and lineage before suppressing
level: critical
---
title: Suspicious HTTP Request Patterns Against Hyperion Financial Management Web Tier
id: 9d4f7a36-2c8b-4e1d-a5f3-8b6c1e9a3d7f
status: experimental
description: Detects suspicious HTTP request characteristics targeting Hyperion Financial Management and WebLogic endpoints commonly probed during exploitation attempts of unauthenticated network-vector Oracle vulnerabilities.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87230
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/hfm'
      - '/HyperionPlanning'
      - '/workspace'
      - '/wls-wsat'
      - '/console'
      - '/bea_wls_internal'
  selection_behavior:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
      - 'PROPFIND'
  selection_payload:
    cs-uri-query|contains:
      - 'cmd'
      - 'exec'
      - '%2e%2e'
      - '..%2f'
      - 'java.lang.Runtime'
      - 'processBuilder'
      - 'bash'
      - 'powershell'
  condition: selection_uri and (selection_behavior or selection_payload)
falsepositives:
  - Legitimate POST traffic to application endpoints; tune URI stems to match your HFM deployment paths
level: high

KQL — Microsoft Sentinel / Defender

This hunt combines endpoint process-lineage telemetry with network connections initiated by Oracle application server processes. It assumes WebLogic/HFM hosts are onboarded to Defender for Endpoint or forwarding Sysmon/Syslog into Sentinel.

// Hunt 1: Oracle WebLogic/HFM Java processes spawning shells or LOLBins (Windows + Linux via MDE)
let lookback = 14d;
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","curl.exe","sh","bash","dash","python","python3","perl","wget","nc","ncat","socat"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("java.exe","java","javaw.exe")
   or InitiatingProcessCommandLine has_any ("weblogic","hyperion","fmwhome","/u01/oracle","/opt/oracle","startManagedWebLogic","NodeManager")
| where FileName in~ (suspiciousChildren)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessId, ProcessId
| order by Timestamp desc;

// Hunt 2: Outbound network connections FROM Oracle app server Java processes to rare external destinations
let lookback2 = 14d;
DeviceNetworkEvents
| where Timestamp > ago(lookback2)
| where InitiatingProcessFileName in~ ("java.exe","java")
   or InitiatingProcessCommandLine has_any ("weblogic","hyperion","fmwhome")
| where RemoteIPType == "Public"
| where RemotePort !in (443, 80) or RemoteUrl !has_any ("oracle.com","microsoft.com") // allow expected update/CDN traffic per your baseline
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
            Ports = make_set(RemotePort), URLs = make_set(RemoteUrl)
  by DeviceName, RemoteIP, InitiatingProcessFileName
| order by ConnectionCount asc; // low-volume rare destinations surface first

Velociraptor VQL

Deploy this hunt across your Hyperion/WebLogic server fleet to enumerate Java process lineage and flag shells or downloaders spawned by the application tier, plus any unexpected listening ports on the hosts.

-- Oracle WebLogic/HFM post-exploitation hunt: suspicious child processes of Java app servers
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(weblogic|hyperion|fmwhome|startManagedWebLogic)'
   OR Exe =~ '(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|/bin/(sh|bash)|/usr/bin/(curl|wget|nc|python))'

-- Correlate: enumerate network listeners on the HFM/WebLogic hosts
SELECT Pid, Name, Address, Port, State
FROM netstat()
WHERE State =~ 'LISTEN'
ORDER BY Port

Verification and Hardening Script

Run the following on Windows-based Hyperion Financial Management servers (the most common HFM deployment platform) to inventory Oracle installations, enumerate listening services that expose the application tier, and collect the patch baseline you need before applying the CPU.

# CVE-2026-87230 / Oracle CPU Response - HFM Server Inventory & Exposure Check
# Run elevated on each Hyperion Financial Management / WebLogic host

$report = @()

# 1) Enumerate installed Oracle products
$oracle = Get-ItemProperty HKLM:\SOFTWARE\Oracle\* -ErrorAction SilentlyContinue |
  Select-Object PSChildName, @{n='OracleHome';e={$_.ORACLE_HOME}}
$report += "=== Installed Oracle Components ==="
$report += ($oracle | Format-Table | Out-String)

# 2) Find WebLogic / HFM processes and their Java versions
$report += "=== Running Oracle Java Processes ==="
$javas = Get-CimInstance Win32_Process -Filter "Name='java.exe' OR Name='javaw.exe'" |
  Where-Object { $_.CommandLine -match 'weblogic|hyperion|fmwhome' }
$report += ($javas | Select-Object ProcessId, ExecutablePath, CommandLine | Format-List | Out-String)

# 3) Identify exposed listeners (HFM/WebLogic commonly: 7001, 7002, 7363, 19000, 10091-10095)
$report += "=== Listening Ports (Oracle-related) ==="
$listeners = Get-NetTCPConnection -State Listen | Where-Object {
  $_.LocalPort -in 7001,7002,7363,19000,10091,10092,10093,10094,10095 -or
  (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path -match 'oracle|hyperion|weblogic'
}
$report += ($listeners | Select-Object LocalAddress, LocalPort, OwningProcess,
  @{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} | Format-Table | Out-String)

# 4) Check for unexpected child processes of Java (quick compromise triage)
$report += "=== Suspicious Children of Java Processes ==="
foreach ($j in $javas) {
  Get-CimInstance Win32_Process -Filter "ParentProcessId=$($j.ProcessId)" |
    Where-Object { $_.Name -match 'cmd|powershell|wscript|cscript|mshta|certutil|bitsadmin|rundll32' } |
    ForEach-Object { $report += "ALERT: Java PID $($j.ProcessId) spawned $($_.Name) :: $($_.CommandLine)" }
}

# 5) Confirm HFM patch level via OPatch (adjust ORACLE_HOME path)
$oh = "C:\Oracle\Middleware\Oracle_Home"  # <-- set to your HFM Oracle home
if (Test-Path "$oh\OPatch\opatch.bat") {
  $report += "=== OPatch Inventory ==="
  $report += (& "$oh\OPatch\opatch.bat" lsinventory -oh $oh 2>&1 | Out-String)
}

$report | Out-File "$env:TEMP\oracle_hfm_audit_$(Get-Date -Format yyyyMMdd_HHmm).txt"
Write-Output "Audit complete. Review output file in $env:TEMP"

For Linux-hosted HFM/WebLogic tiers, this Bash equivalent collects the same baseline:

#!/bin/bash
# Oracle HFM/WebLogic exposure and triage audit - run as the oracle/install owner or root
OUT="/tmp/oracle_hfm_audit_$(date +%Y%m%d_%H%M).txt"
{
echo "=== Java processes tied to WebLogic/HFM ==="
ps -eo pid,ppid,user,cmd | grep -iE 'weblogic|hyperion|fmwhome' | grep -v grep

echo "=== Listening sockets owned by Java ==="
ss -tlnp 2>/dev/null | grep -i java

echo "=== Suspicious child processes of Java PIDs ==="
for pid in $(pgrep -f 'java.*(weblogic|hyperion|fmwhome)'); do
  ps --ppid "$pid" -o pid,cmd | grep -iE 'sh|bash|curl|wget|nc|python|perl' && echo "ALERT: java PID $pid spawned shell"
done

echo "=== OPatch inventory (adjust ORACLE_HOME) ==="
OH="/u01/oracle/Middleware/Oracle_Home"
[ -x "$OH/OPatch/opatch" ] && "$OH/OPatch/opatch" lsinventory -oh "$OH"
} | tee "$OUT"
echo "Audit written to $OUT"

Remediation

1. Obtain the official advisory first. Go to Oracle's Critical Patch Updates page (https://www.oracle.com/security-alerts/) and pull the current CPU advisory plus the CVE-specific risk matrices. Map all 37 CVEs — starting with CVE-2026-87230 — to the products and supported versions in your inventory. NVD entries (e.g., https://nvd.nist.gov/vuln/detail/CVE-2026-87230) are the reference, but Oracle's advisory carries the authoritative affected-version and patch-number data.

2. Patch in severity order, not alphabetical order. CVE-2026-87230 (CVSS 10.0, Hyperion Financial Management) goes first. Then any CVE affecting internet-facing or DMZ-adjacent Oracle components. Then internal-only components. Use OPatch (opatch apply after opatch lsinventory baseline) for HFM/WebLogic homes, and validate in a non-production EPM environment before production cutover — HFM patch regressions during close cycles are painful, but a CVSS 10.0 unauthenticated flaw does not wait for your fiscal calendar.

3. If patching must wait, reduce exposure now:

   • Confirm HFM/WebLogic interfaces are not internet-reachable. Scan externally and check load balancer, reverse proxy, and firewall rules. These are internal financial systems; there is almost never a legitimate reason for direct external exposure.
   • Restrict access to WebLogic administration consoles and HFM application ports to a dedicated management VLAN / jump host ACL.
   • Place a WAF in front of the EPM web tier with rules blocking path traversal, Java deserialization signatures, and unexpected HTTP methods.

4. Enforce least privilege on service accounts. The WebLogic/HFM service account should not be a local administrator, should not hold domain-level privileges, and should have database access scoped to only the schemas HFM requires. This directly blunts the "Scope: Changed" impact of CVE-2026-87230.

5. Hunt before you patch. Deploy the Sigma, KQL, and VQL content above against your Oracle server fleet immediately, covering at least the last 14–30 days. Given the disclosure timeline, you need to establish whether exploitation preceded your patch — patching a compromised host without IR is how you inherit a persistent intruder.

6. Close the telemetry gap permanently. Onboard HFM/WebLogic hosts to EDR, forward WebLogic access logs (access.log) and domain logs to your SIEM, and alert on the process-lineage detections above as standing content. EPM platforms holding consolidated financial results deserve the same monitoring tier as your domain controllers.

7. Track KEV. Monitor CISA's KEV catalog daily for any of these 37 CVEs. If any entry lands on KEV, federal deadlines (typically 1–3 weeks under BOD 22-01) apply to FCEB agencies, and every private-sector organization should treat that as its effective patch deadline as well.

Bottom Line

Thirty-seven critical, network-exploitable Oracle CVEs in three days — with a CVSS 10.0 unauthenticated flaw in Hyperion Financial Management at the front of the pack — is a patching emergency for any organization running Oracle EPM. The patch-diff clock started the moment the CPU dropped. Inventory, hunt, patch, and verify — in that order, and starting today.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub