CVE-2026-87128 is a critical security vulnerability in Oracle Hyperion Data Relationship Management version 11.2.26.0.000 affecting the access and security component. The flaw permits unauthenticated remote attackers to compromise the system via HTTP, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The vulnerability has a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating it is remotely exploitable with low attack complexity and no privileges or user interaction required. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across multiple products including Oracle Hyperion Data Relationship Management.

Successful exploitation allows an unauthenticated attacker to gain unauthorized creation, deletion, or modification access to critical data or full access to all data accessible by Oracle Hyperion Data Relationship Management 11.2.26.0.000. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is remotely exploitable over HTTP without any authentication or user interaction.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to remediate this issue. Oracle emphasizes remaining on actively supported versions and applying security patches without delay to prevent exploitation. No vendor advisory states that no action is required or that the issue is already mitigated without patching.