CVE-2026-87132 is a vulnerability in Oracle Hyperion Data Relationship Management (component: Access and security) version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product by requiring user interaction from a third party. Successful exploitation can result in unauthorized access to critical data or full access to all accessible data within Oracle Hyperion Data Relationship Management, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows unauthorized access to critical data and potentially complete access to all data accessible by Oracle Hyperion Data Relationship Management. It also permits unauthorized modification (update, insert, delete) of some data. The scope of impact extends beyond the immediate product, potentially affecting additional Oracle Hyperion products. The CVSS score of 7.6 indicates a high severity vulnerability with significant confidentiality and integrity impacts.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.