CVE-2026-87146 is a vulnerability in the access and security component of Oracle Hyperion Data Relationship Management version 11.2.26.0.000. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and unauthorized modification of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data within Oracle Hyperion Data Relationship Management. This compromises confidentiality and integrity of data but does not affect availability. The vulnerability is exploitable remotely by an attacker with low privileges and network access via HTTP.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the patch promptly to remediate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.